Marsalek Malware Disguised as Game Cheats Uses Dual-Hook Setup to Steal Passwords and Wallets
Do Son 
Attack Vector | Image: McAfee Labs
At a Glance
| Malware Family | Marsalek malware (Python intermediate stealers and PureLog .NET fourth-stage infostealer) |
| Threat Actor | Confirmed link to the WeedHack MaaS ecosystem via the @MetaMaskenMann Telegram support channel; PureLog originally created by “PureCoder” |
| Target / Victims | Players of Roblox, Fortnite, Minecraft, Counter-Strike 2, and Grim Dawn; highest activity in the US, Germany, UK, India, Brazil, Poland, Netherlands, Italy, and Canada (over 1,560 registered MaaS accounts, 400+ files, 29+ URLs) |
| Delivery Vector | Fake game cheats, Roblox executors, hardware ID spoofers, and ClickFix CAPTCHA pages spread via Discord, GitHub, and lookalike websites |
| Key Capabilities | CMSTP.exe UAC bypass, Chrome App-Bound Encryption bypass via DLL injection, Exodus and Atomic Wallet backdooring, dual-hook exfiltration |
TL;DR
McAfee Labs uncovered a free Malware-as-a-Service operation that distributed Marsalek malware disguised as cheats for Roblox, Fortnite, Minecraft, and Counter-Strike 2. Active from December 2025 through May 2026, the platform attracted over 1,560 registered users who built more than 400 malicious files across 29 distribution domains. However, the dual-hook Marsalek malware secretly deploys a fourth-stage PureLog stealer that sends a second copy of every victim’s stolen passwords and crypto wallets directly to the platform creator.
Delivery and Attribution
Between mid-December 2025 and late May 2026, operators promoted a free web dashboard that let anyone generate custom stealers without needing an email address or Discord login. Customers used the portal’s four builders to create weaponized Python scripts, encoded PowerShell commands, standalone Windows executables, and fake Cloudflare ClickFix verification pages. Affiliates then distributed these files across Discord, GitHub, and lookalike sites as Roblox script executors like Swift, Solara, MatrixHub External, and Matcha External, or Minecraft clients like Shadow Client and Boss Client. Other lures impersonated Grim Dawn mods, hardware ID spoofers, and cookie checkers.
Confirmed Versus Suspected Attribution
Confirmed technical attribution links this campaign directly to the WeedHack operation that targeted Minecraft players earlier in 2026. Specifically, both platforms shared final-stage payloads and directed users to the exact same Telegram support handle, @MetaMaskenMann. While confirmed attribution to a real-world identity does not exist, suspected attribution points to a financially motivated developer who used free access to recruit over 1,560 affiliates as an unpaid distribution workforce. Telemetry showed victim infections concentrated primarily in the United States, followed by Germany, the United Kingdom, India, Brazil, Poland, the Netherlands, Italy, and Canada.
Infection Chain
Regardless of whether an affiliate uses a ClickFix page, a script, or an executable, the first stage installs a portable Python environment alongside the cryptography, fernet, and requests libraries. Next, the loader fetches a second-stage script named python_setup.py using Fernet encryption. If the script lacks administrator rights, it drops a malicious INF profile into the temporary folder and runs the native Windows utility cmstp.exe with the /au flag. When the User Account Control prompt appears, a Python loop hides the window and simulates an Enter keystroke to grant itself administrative privileges.
Defender Exclusions and Browser Injection
Once elevated, the script runs a batch file named WinDefConfig.cmd that adds eight folder paths and 15 process names to the Windows Defender exclusion list. Afterward, it decrypts and runs the 1,400-line third-stage script, svc.py. To defeat Chrome’s App-Bound Encryption on Chrome, Edge, and Brave, the script launches the target browser in a suspended state and sets up a named pipe. It then injects a decrypted DLL into the suspended browser process so the request to the browser’s Elevation Service originates from inside the trusted binary path. Meanwhile, for Firefox, the script loads Mozilla’s legitimate nss3.dll library to call the internal PK11SDR_Decrypt routine directly.
Command-and-Control and Data-Exfiltration Behavior
The Python stealer harvests logins and cookies from 32 Chromium browsers and Firefox, collects data from 56 cryptocurrency browser extensions and 12 desktop wallets, and searches five user folders for files matching 24 sensitive keywords. It also terminates Telegram to zip the local tdata session folder, queries the Mullvad VPN command-line tool for account numbers, and checks 26 file paths for Discord tokens before validating them against Discord’s API. Worse still, if the Marsalek malware detects Exodus or Atomic Wallet on the PC, it overwrites their local app.asar archives with trojanized copies to plant a persistent wallet backdoor.
Dual-Hook PureLog Betrayal
After sending the compressed archive to the primary command server so the affiliate can view it on their web dashboard, the script downloads a fourth-stage payload: PureLog Stealer. Protected by .NET Reactor and encrypted with Triple DES, PureLog loads directly in memory, registers a scheduled task named RunetimeBroker.exe that runs every five minutes, and scans 35 browsers and 48 extensions. According to the McAfee Labs research report, “This double credential harvesting reveals that the campaign is dual hooked. The attacker behind the campaign retains access to all the credentials harvested by Marsalek. Consequently, if any customer is able to infect a high value victim, then Marsalek’s author may be able to exploit the stolen credentials before the customer.” PureLog transmits its stolen data over a certificate-pinned TLS connection to a separate command server, ensuring the platform owner profits first while affiliates shoulder the operational risk.
Defense and Detection Guidance
Even though the main dashboard went offline in May 2026, MalwareTips warn that previously distributed cheat installers and persistent scheduled tasks remain dangerous. As McAfee researchers noted, “Downloading what appears to be a free game modification or useful application could expose saved passwords, online accounts, cryptocurrency wallets, and sensitive personal files to cybercriminals.” Gamers should avoid unverified script executors and never disable antivirus tools to run a game mod. Security teams can detect the dual-hook Marsalek malware by alerting on cmstp.exe executions using the /au switch, auditing Windows Defender for mass PowerShell exclusion rules, and checking Task Scheduler for rogue RunetimeBroker.exe tasks. Victims who ran a suspected cheat should reinstall Exodus and Atomic Wallet from official websites, revoke active sessions, and rotate all passwords and wallet seed phrases from a clean computer.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
