Marsalek free Malware-as-a-Service hid a dual-hook PureLog stealer in fake Roblox, Fortnite and Minecraft cheats
McAfee Labs documented Marsalek, a free Malware-as-a-Service platform active from mid-December 2025 to late May 2026 that distributed infostealers disguised as cheats and script executors for Roblox, Fortnite, Minecraft and Counter-Strike 2. The dashboard required no email or Discord account and drew more than 1,560 registered users, who generated over 400 malicious files spread across 29 distribution domains via Discord, GitHub and lookalike sites. Every build was dual-hooked: besides sending stolen data to the affiliate's panel, it dropped a fourth-stage PureLog Stealer that exfiltrated a second copy of credentials and wallets to the platform owner, letting the operator monetise high-value victims before the customer. Technical attribution links the platform to the earlier 2026 WeedHack operation targeting Minecraft players through shared final-stage payloads and the same Telegram support handle, @MetaMaskenMann; no real-world identity is confirmed. Infections concentrated in the United States, then Germany, the United Kingdom, India, Brazil, Poland, the Netherlands, Italy and Canada. Independent reporting corroborates the McAfee findings on scope, free tier and dual-hook design (rodtrent.substack.com, brandefense.io); the main dashboard went offline in May 2026, but distributed installers and persistent tasks remain active.
Detalhes técnicos
All four builders (Python script, encoded PowerShell, standalone Windows PE, and fake Cloudflare ClickFix verification pages) converge on the same chain. Stage one installs a portable Python runtime with the cryptography, fernet and requests libraries, then fetches a Fernet-encrypted second stage, python_setup.py. Without administrator rights it writes a malicious INF profile to the temp folder and abuses the signed Windows binary cmstp.exe with the /au flag; a Python loop hides the UAC prompt window and simulates an Enter keystroke to self-elevate. Once elevated, WinDefConfig.cmd adds eight folder paths and 15 process names to Windows Defender exclusions, then the 1,400-line third stage svc.py runs. To defeat Chrome App-Bound Encryption in Chrome, Edge and Brave, it starts the browser suspended, sets up a named pipe and injects a decrypted DLL so the Elevation Service request comes from the trusted binary path; for Firefox it loads nss3.dll and calls PK11SDR_Decrypt directly. Collection covers 32 Chromium browsers and Firefox, 56 crypto browser extensions, 12 desktop wallets, five user folders matched against 24 keywords, Telegram tdata sessions, Mullvad VPN account numbers and 26 paths for Discord tokens validated against the Discord API. If Exodus or Atomic Wallet is present, their app.asar archives are overwritten with trojanized copies as a persistent wallet backdoor. PureLog Stealer, protected with .NET Reactor and Triple DES, loads in memory, registers a scheduled task named RunetimeBroker.exe running every five minutes, scans 35 browsers and 48 extensions, and exfiltrates over certificate-pinned TLS to a separate C2.
Remediação
Hunt for cmstp.exe executions with the /au switch, audit Windows Defender for bulk folder and PowerShell process exclusions, and review Task Scheduler for rogue RunetimeBroker.exe entries. Block and warn against unverified script executors and game mods, and never allow antivirus to be disabled to run one. Affected users should reinstall Exodus and Atomic Wallet from official sites, revoke active sessions, and rotate all passwords and wallet seed phrases from a clean machine.
Linha do tempo
-
Marsalek free Malware-as-a-Service hid a dual-hook PureLog stealer in fake Roblox, Fortnite and Minecraft cheats
ler a análise desta fonte ocultar
McAfee Labs documented Marsalek, a free Malware-as-a-Service platform active from mid-December 2025 to late May 2026 that distributed infostealers disguised as cheats and script executors for Roblox, Fortnite, Minecraft and Counter-Strike 2. The dashboard required no email or Discord account and drew more than 1,560 registered users, who generated over 400 malicious files spread across 29 distribution domains via Discord, GitHub and lookalike sites. Every build was dual-hooked: besides sending stolen data to the affiliate's panel, it dropped a fourth-stage PureLog Stealer that exfiltrated a second copy of credentials and wallets to the platform owner, letting the operator monetise high-value victims before the customer. Technical attribution links the platform to the earlier 2026 WeedHack operation targeting Minecraft players through shared final-stage payloads and the same Telegram support handle, @MetaMaskenMann; no real-world identity is confirmed. Infections concentrated in the United States, then Germany, the United Kingdom, India, Brazil, Poland, the Netherlands, Italy and Canada. Independent reporting corroborates the McAfee findings on scope, free tier and dual-hook design (rodtrent.substack.com, brandefense.io); the main dashboard went offline in May 2026, but distributed installers and persistent tasks remain active.
Technical Details
All four builders (Python script, encoded PowerShell, standalone Windows PE, and fake Cloudflare ClickFix verification pages) converge on the same chain. Stage one installs a portable Python runtime with the cryptography, fernet and requests libraries, then fetches a Fernet-encrypted second stage,
python_setup.py. Without administrator rights it writes a malicious INF profile to the temp folder and abuses the signed Windows binary cmstp.exe with the/auflag; a Python loop hides the UAC prompt window and simulates an Enter keystroke to self-elevate. Once elevated,WinDefConfig.cmdadds eight folder paths and 15 process names to Windows Defender exclusions, then the 1,400-line third stagesvc.pyruns. To defeat Chrome App-Bound Encryption in Chrome, Edge and Brave, it starts the browser suspended, sets up a named pipe and injects a decrypted DLL so the Elevation Service request comes from the trusted binary path; for Firefox it loadsnss3.dlland callsPK11SDR_Decryptdirectly. Collection covers 32 Chromium browsers and Firefox, 56 crypto browser extensions, 12 desktop wallets, five user folders matched against 24 keywords, Telegramtdatasessions, Mullvad VPN account numbers and 26 paths for Discord tokens validated against the Discord API. If Exodus or Atomic Wallet is present, theirapp.asararchives are overwritten with trojanized copies as a persistent wallet backdoor. PureLog Stealer, protected with .NET Reactor and Triple DES, loads in memory, registers a scheduled task namedRunetimeBroker.exerunning every five minutes, scans 35 browsers and 48 extensions, and exfiltrates over certificate-pinned TLS to a separate C2.Remediation
Hunt for cmstp.exe executions with the
/auswitch, audit Windows Defender for bulk folder and PowerShell process exclusions, and review Task Scheduler for rogueRunetimeBroker.exeentries. Block and warn against unverified script executors and game mods, and never allow antivirus to be disabled to run one. Affected users should reinstall Exodus and Atomic Wallet from official sites, revoke active sessions, and rotate all passwords and wallet seed phrases from a clean machine.