Hackers are deploying the Marsalek information stealer by dressing it up as fake cheats or utilities for Roblox, Fortnite, Counter-Strike 2, and other games. What looks like harmless game add-ons are actually designed to swipe saved passwords, browser cookies, Discord tokens, and crypto wallet data from Windows PCs. These deceptive tools have been circulating since at least December 2025.
How Marsalek Is Spread and Built
The campaign works by offering bogus script executors—tools gamers often search for—such as Swift, Solara, MatrixHub External, Matcha External, and fake Minecraft clients like Shadow Client or Boss Client. A file labeled Fortnite_tweaks.exe is part of this collection. Attackers distribute these malicious files via look-alike websites, GitHub, Discord, and download portals. Victims may run a PowerShell script, a Python file, or an EXE to start the infection.
Once triggered, a “starter” script retrieves a portable Python package and a file called python_setup.py. This script tries to gain administrator privileges through a Windows tool named CMSTP, suppresses the permission prompt, and adds multiple system paths and processes to Microsoft Defender’s exclusion list to evade detection. From there, a file called svc.py executes the data theft, targeting over 30 Chromium-based browsers plus Firefox to harvest credentials, cookies, Discord/Telegram session data, VPN account details, and browser extensions. Wallets and files with names like “seed,” “wallet,” or “passphrase” are also sought. For some wallet apps, attackers replace or insert modified files to facilitate backdoors.
A Dual-Hook System & Scope of the Operation
Marsalek operates with two hooks. First, customers who buy or build payloads think they alone control the stolen data. Unbeknownst to them, the malware’s operator also receives a copy in parallel—allowing them to leverage high-value compromised accounts independently. This setup includes built-in instructions for misusing stolen Discord cookies and for laundering cryptocurrency via Monero.
During its public malware-as-a-service phase (December 2025 to May 2026), Marsalek allowed anyone to sign up on its site, build malicious files, and monitor victims through a dashboard. The free tier required no email or Discord signup.
McAfee Labs, which uncovered the scheme, tallied more than 1,560 registered users, 400+ unique malicious files, and over 29 URLs used for distributing infected executables. The United States was the most impacted country, followed by Germany, the UK, India, and Brazil.
Protecting Yourself & Recovery Steps
To stay safe: only get game tools from official sources; never disable antivirus warnings dismissed as false alarms; avoid pasting PowerShell or other commands from a webpage. If you believe you’ve used a compromised cheat, change your passwords using a clean device, log out of all sessions, migrate crypto to a fresh wallet, and consider reinstalling Windows. Also review the IoCs identified—hashed filenames, specific distribution URLs, and command & control domains.
The useful Signs of Compromise include sample names such as fake CAPTCHA pages, Fortnite_tweaks.exe, build_1280.exe, ShadowClient.exe, Matrix-Hub-External-Cracked/newuimatrix.exe, CS2-TriggerBot-main.py, and executables hosted on file sharing services or GitHub leaks. Primary domains used for command & control include marsalek.cy, telemetrydata.to, and huehnchenfarm.ru.
This attack builds on long-standing trends: malicious actors exploiting gamers by packaging malware as cheats; the growing popularity of malware-as-a-service; and stealth tactics like memory-only execution and exclusion from antivirus scan paths. Marsalek combines all these into a powerful, deceptive threat that operates at scale.
What this means: For gamers, content creators, and anyone tempted by “free cheats,” this is a wake-up call: the tools promising advantage may be the gateway for significant losses. On an industry level, Marsalek underscores how supply-chain and distribution channels that are supposed to be benign (Discord, GitHub, gaming forums) are being weaponized. Watch for security tools that detect exclusion-based persistence, memory-based backdoors, and dual-hook systems—those might be your early warning signs.
