Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data

Hackers are hiding a free information stealer called Marsalek inside fake cheats and tools for games such as Roblox, Fortnite, and Counter-Strike 2.

The files look like helpful game add-ons. In the background they steal saved passwords, browser cookies, Discord tokens, and crypto wallet data from Windows PCs.

Marsalek ran from about December 2025 to May 2026 as malware-as-a-service, so anyone could sign up on a public site, build a malicious file, and watch victims on a dashboard.

The free tier did not even ask for a Discord or email account. Similar fake game cheat campaigns have pushed other stealers through GitHub and Reddit, which shows how popular this trick has become.

Analysts at McAfee Labs identified the malware and counted more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs.

They also linked Marsalek to WeedHack, a Minecraft-focused service, because both point customers to the same Telegram support channel, @MetaMaskenMann.

Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats

Most of the lures copy tools that gamers already search for. McAfee saw fake versions of Roblox script executors such as Swift, Solara, MatrixHub External, and Matcha External.

Fake Minecraft clients such as Shadow Client and Boss Client also appeared, and a sample named Fortnite_tweaks.exe is in the indicator list.

The files spread through look-alike websites, Discord, and GitHub. Customers can start an infection with a PowerShell script, a ClickFix page, a Python file, or an EXE file. Bitdefender reported a related case with fake Roblox Xeno cheats that also targeted younger players.

After the first step, the chain is almost the same every time. The starter script downloads a portable Python package and a second file called python_setup.py.

That file tries to gain admin rights with a Windows tool called CMSTP, then hides the permission prompt and presses Enter for the user. It then adds 8 paths and 15 processes to Microsoft Defender’s exclusion list, so later files are not scanned.

The ClickFix page is a fake Cloudflare check, a trick also seen in the Warden Stealer malware campaign that tells victims to paste commands into Windows.

The third file, svc.py, does the main stealing in over 1,400 lines of code. It goes after 32 Chromium-based browsers and Firefox.

It also gets around Chrome’s App-Bound Encryption by injecting a DLL into a suspended Chrome, Edge, or Brave process, so the browser itself unlocks the key.

The malware checks 26 Discord paths, copies Telegram session data, and reads Mullvad VPN account details. It scans for 56 browser extensions and 12 wallet apps, and it looks for files with words like “seed,” “passphrase,” and “wallet.” In Exodus and Atomic Wallet it swaps in two .asar files to leave a backdoor.

Dual-Hook Design Turns Customers Into Victims

The last stage is PureLog, a low-cost stealer sold for as little as $59 a month. It is hidden with .NET Reactor, decrypted with Triple DES, and run only in memory.

It targets 35 browsers, 48 extensions, and 12 desktop apps, takes a screenshot, and sets a scheduled task that runs RunetimeBroker.exe every five minutes. It sends data to a separate server, telemetrydata.to.

This setup is called a dual hook. The customers think they own the stolen logs, but Marsalek’s author also gets a copy and may use a high-value victim’s accounts first.

The built-in FAQ even teaches buyers how to use stolen cookies and tokens and how to launder coins through Monero. McAfee saw the most activity in the United States, followed by Germany, the United Kingdom, India, and Brazil.

Gaming profiles are worth money, and it is easy to see attackers steal gaming accounts and then sell the items or reuse the same logins elsewhere.

The best defense is simple. Download games and tools only from official sources, never turn off antivirus because a site says it is a false alarm, and never paste commands from a web page.

Anyone who ran a suspicious cheat should change passwords from a clean device, sign out of all sessions, move crypto to a new wallet, and reinstall Windows. Readers can find the full technical details in the McAfee Labs Marsalek report.

Indicators of compromise (IoCs):-

SHA256 hashes

Domains and distribution URLs

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data appeared first on Cyber Security News.