Marsalek MaaS Infostealer Targets Gamers via Fake Roblox/Minecraft Cheats, Bypasses Chrome App-Bound Encryption
Marsalek is a free malware-as-a-service (MaaS) platform active from mid-December 2025 to late May 2026 that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. Researchers tied the campaign to more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs. Marsalek ran in parallel with WeedHack, a Minecraft-focused MaaS campaign previously documented by McAfee, sharing the same Telegram support handle @MetaMaskenMann and final-stage payloads, though Marsalek uses Python instead of Java for intermediate stages. The malware steals browser passwords, cookies, Discord tokens, Telegram sessions, Mullvad VPN data and crypto wallet files, and notably bypasses Chrome's App-Bound Encryption to decrypt stolen credentials.
Detalhes técnicos
Customers choose from four stage-one vectors: PowerShell, ClickFix fake CAPTCHA pages, Python scripts, and PE executables, posing as Roblox executors (Solara, Swift) or Minecraft clients (Shadow Client). Each downloads a portable Python runtime and installs packages (cryptography, requests). Stage two, python_setup.py, escalates privileges via a CMSTP UAC bypass (same technique as WeedHack) and writes WinDefConfig.cmd, adding 8 Defender exclusion paths and 15 excluded processes. Stage three, svc.py (~1,400 lines), targets 32 Chromium browsers, Firefox, 56 browser extensions, and 12 desktop crypto wallets, harvesting Discord tokens from 26 paths plus Telegram and Mullvad VPN data; it also scans for files matching 24 keywords such as "seed," "wallet," and "passphrase," and persists via the Startup folder and scheduled tasks. To bypass Chrome's App-Bound Encryption on Chrome, Edge, and Brave, the malware launches the browser suspended, injects a DLL, and tricks the Elevation Service into decrypting the master key, then decrypts v20-prefixed cookies, passwords, and tokens with AES-GCM. It also backdoors Exodus and Atomic Wallet by replacing files with malicious .asar archives. The final stage loads PureLog Stealer in memory (obfuscated with .NET Reactor, decrypted via 3DES and GZIP), which exfiltrates data to a separate C2 server, meaning the campaign operator intercepts data collected by their own MaaS customers. The dashboard's FAQ instructed customers on cashing out stolen cookies/tokens and laundering crypto via Monero using services like ETZ-swap and Trocador. McAfee observed the highest infection counts in the United States, followed by Germany, the UK, India, and Brazil, with many apparent customers being teenagers. WeedHack sites remained active as of August 2026, spreading via SEO poisoning.
Remediação
Avoid executables shared on Discord and cracked or cheat software from unofficial sites; treat any instruction to disable antivirus as a red flag. Defenders should monitor for cmstp.exe launched with the /au flag, bulk Microsoft Defender exclusion changes, and unexpected Python runtimes in user directories. Users who ran such files should rotate passwords, revoke sessions and Discord tokens, and migrate crypto holdings to new wallets.
Linha do tempo
-
Marsalek MaaS Infostealer Targets Gamers via Fake Roblox/Minecraft Cheats, Bypasses Chrome App-Bound Encryption
ler a análise desta fonte ocultar
Marsalek is a free malware-as-a-service (MaaS) platform active from mid-December 2025 to late May 2026 that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. Researchers tied the campaign to more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs. Marsalek ran in parallel with WeedHack, a Minecraft-focused MaaS campaign previously documented by McAfee, sharing the same Telegram support handle
@MetaMaskenMannand final-stage payloads, though Marsalek uses Python instead of Java for intermediate stages. The malware steals browser passwords, cookies, Discord tokens, Telegram sessions, Mullvad VPN data and crypto wallet files, and notably bypasses Chrome's App-Bound Encryption to decrypt stolen credentials.Technical Details
Customers choose from four stage-one vectors: PowerShell, ClickFix fake CAPTCHA pages, Python scripts, and PE executables, posing as Roblox executors (Solara, Swift) or Minecraft clients (Shadow Client). Each downloads a portable Python runtime and installs packages (
cryptography,requests). Stage two,python_setup.py, escalates privileges via a CMSTP UAC bypass (same technique as WeedHack) and writesWinDefConfig.cmd, adding 8 Defender exclusion paths and 15 excluded processes. Stage three,svc.py(~1,400 lines), targets 32 Chromium browsers, Firefox, 56 browser extensions, and 12 desktop crypto wallets, harvesting Discord tokens from 26 paths plus Telegram and Mullvad VPN data; it also scans for files matching 24 keywords such as "seed," "wallet," and "passphrase," and persists via the Startup folder and scheduled tasks. To bypass Chrome's App-Bound Encryption on Chrome, Edge, and Brave, the malware launches the browser suspended, injects a DLL, and tricks the Elevation Service into decrypting the master key, then decrypts v20-prefixed cookies, passwords, and tokens with AES-GCM. It also backdoors Exodus and Atomic Wallet by replacing files with malicious.asararchives. The final stage loads PureLog Stealer in memory (obfuscated with .NET Reactor, decrypted via 3DES and GZIP), which exfiltrates data to a separate C2 server, meaning the campaign operator intercepts data collected by their own MaaS customers. The dashboard's FAQ instructed customers on cashing out stolen cookies/tokens and laundering crypto via Monero using services like ETZ-swap and Trocador. McAfee observed the highest infection counts in the United States, followed by Germany, the UK, India, and Brazil, with many apparent customers being teenagers. WeedHack sites remained active as of August 2026, spreading via SEO poisoning.Remediation
Avoid executables shared on Discord and cracked or cheat software from unofficial sites; treat any instruction to disable antivirus as a red flag. Defenders should monitor for
cmstp.exelaunched with the/auflag, bulk Microsoft Defender exclusion changes, and unexpected Python runtimes in user directories. Users who ran such files should rotate passwords, revoke sessions and Discord tokens, and migrate crypto holdings to new wallets.