Marsalek free MaaS spreads PureLog Stealer via fake Roblox, Fortnite and Minecraft cheats, bypassing Chrome App-Bound Encryption

Linha do tempo

1. securityonline.info ↗ · pub. 09/11/2026 04:15 · coletado 09/11 05:00

   Marsalek free Malware-as-a-Service hid a dual-hook PureLog stealer in fake Roblox, Fortnite and Minecraft cheats

   ler a análise desta fonte ocultar

   McAfee Labs documented Marsalek, a free Malware-as-a-Service platform active from mid-December 2025 to late May 2026 that distributed infostealers disguised as cheats and script executors for Roblox, Fortnite, Minecraft and Counter-Strike 2. The dashboard required no email or Discord account and drew more than 1,560 registered users, who generated over 400 malicious files spread across 29 distribution domains via Discord, GitHub and lookalike sites. Every build was dual-hooked: besides sending stolen data to the affiliate's panel, it dropped a fourth-stage PureLog Stealer that exfiltrated a second copy of credentials and wallets to the platform owner, letting the operator monetise high-value victims before the customer. Technical attribution links the platform to the earlier 2026 WeedHack operation targeting Minecraft players through shared final-stage payloads and the same Telegram support handle, @MetaMaskenMann; no real-world identity is confirmed. Infections concentrated in the United States, then Germany, the United Kingdom, India, Brazil, Poland, the Netherlands, Italy and Canada. Independent reporting corroborates the McAfee findings on scope, free tier and dual-hook design (rodtrent.substack.com, brandefense.io); the main dashboard went offline in May 2026, but distributed installers and persistent tasks remain active.

   Technical Details

   All four builders (Python script, encoded PowerShell, standalone Windows PE, and fake Cloudflare ClickFix verification pages) converge on the same chain. Stage one installs a portable Python runtime with the cryptography, fernet and requests libraries, then fetches a Fernet-encrypted second stage, python_setup.py. Without administrator rights it writes a malicious INF profile to the temp folder and abuses the signed Windows binary cmstp.exe with the /au flag; a Python loop hides the UAC prompt window and simulates an Enter keystroke to self-elevate. Once elevated, WinDefConfig.cmd adds eight folder paths and 15 process names to Windows Defender exclusions, then the 1,400-line third stage svc.py runs. To defeat Chrome App-Bound Encryption in Chrome, Edge and Brave, it starts the browser suspended, sets up a named pipe and injects a decrypted DLL so the Elevation Service request comes from the trusted binary path; for Firefox it loads nss3.dll and calls PK11SDR_Decrypt directly. Collection covers 32 Chromium browsers and Firefox, 56 crypto browser extensions, 12 desktop wallets, five user folders matched against 24 keywords, Telegram tdata sessions, Mullvad VPN account numbers and 26 paths for Discord tokens validated against the Discord API. If Exodus or Atomic Wallet is present, their app.asar archives are overwritten with trojanized copies as a persistent wallet backdoor. PureLog Stealer, protected with .NET Reactor and Triple DES, loads in memory, registers a scheduled task named RunetimeBroker.exe running every five minutes, scans 35 browsers and 48 extensions, and exfiltrates over certificate-pinned TLS to a separate C2.

   Remediation

   Hunt for cmstp.exe executions with the /au switch, audit Windows Defender for bulk folder and PowerShell process exclusions, and review Task Scheduler for rogue RunetimeBroker.exe entries. Block and warn against unverified script executors and game mods, and never allow antivirus to be disabled to run one. Affected users should reinstall Exodus and Atomic Wallet from official sites, revoke active sessions, and rotate all passwords and wallet seed phrases from a clean machine.

2. gbhackers.com ↗ · pub. 05/11/2026 07:05 · coletado 05/11 08:00 primeiro registro

   Marsalek MaaS Infostealer Targets Gamers via Fake Roblox/Minecraft Cheats, Bypasses Chrome App-Bound Encryption

   ler a análise desta fonte ocultar

   Marsalek is a free malware-as-a-service (MaaS) platform active from mid-December 2025 to late May 2026 that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. Researchers tied the campaign to more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs. Marsalek ran in parallel with WeedHack, a Minecraft-focused MaaS campaign previously documented by McAfee, sharing the same Telegram support handle @MetaMaskenMann and final-stage payloads, though Marsalek uses Python instead of Java for intermediate stages. The malware steals browser passwords, cookies, Discord tokens, Telegram sessions, Mullvad VPN data and crypto wallet files, and notably bypasses Chrome's App-Bound Encryption to decrypt stolen credentials.

   Technical Details

   Customers choose from four stage-one vectors: PowerShell, ClickFix fake CAPTCHA pages, Python scripts, and PE executables, posing as Roblox executors (Solara, Swift) or Minecraft clients (Shadow Client). Each downloads a portable Python runtime and installs packages (cryptography, requests). Stage two, python_setup.py, escalates privileges via a CMSTP UAC bypass (same technique as WeedHack) and writes WinDefConfig.cmd, adding 8 Defender exclusion paths and 15 excluded processes. Stage three, svc.py (~1,400 lines), targets 32 Chromium browsers, Firefox, 56 browser extensions, and 12 desktop crypto wallets, harvesting Discord tokens from 26 paths plus Telegram and Mullvad VPN data; it also scans for files matching 24 keywords such as "seed," "wallet," and "passphrase," and persists via the Startup folder and scheduled tasks. To bypass Chrome's App-Bound Encryption on Chrome, Edge, and Brave, the malware launches the browser suspended, injects a DLL, and tricks the Elevation Service into decrypting the master key, then decrypts v20-prefixed cookies, passwords, and tokens with AES-GCM. It also backdoors Exodus and Atomic Wallet by replacing files with malicious .asar archives. The final stage loads PureLog Stealer in memory (obfuscated with .NET Reactor, decrypted via 3DES and GZIP), which exfiltrates data to a separate C2 server, meaning the campaign operator intercepts data collected by their own MaaS customers. The dashboard's FAQ instructed customers on cashing out stolen cookies/tokens and laundering crypto via Monero using services like ETZ-swap and Trocador. McAfee observed the highest infection counts in the United States, followed by Germany, the UK, India, and Brazil, with many apparent customers being teenagers. WeedHack sites remained active as of August 2026, spreading via SEO poisoning.

   Remediation

   Avoid executables shared on Discord and cracked or cheat software from unofficial sites; treat any instruction to disable antivirus as a red flag. Defenders should monitor for cmstp.exe launched with the /au flag, bulk Microsoft Defender exclusion changes, and unexpected Python runtimes in user directories. Users who ran such files should rotate passwords, revoke sessions and Discord tokens, and migrate crypto holdings to new wallets.