Malware News McAfee Labs uncovered Marsalek, a free malware-as-a-service operation disguised as gaming cheats that stole credentials and cryptocurrency data.

[Khushal]

Content source

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/marsalek-malware-fake-game-cheats-password-theft/

Introduction​

Malware-as-a-service (MaaS) is becoming increasingly accessible within online gaming communities and across the internet. Sophisticated malware that once required technical expertise to develop can now be obtained for free, giving aspiring hackers the tools to target unsuspecting victims. For younger users in particular, what begins as curiosity or experimentation can become a gateway into cybercrime, potentially desensitizing them to the real-world consequences of their actions.

Following our investigation into WeedHack, a malware-as-a-service campaign targeting Minecraft players, McAfee Labs has uncovered another operation linked to the same cybercriminal ecosystem. Called Marsalek, this campaign expanded its reach beyond Minecraft by disguising malicious software as popular gaming tools, cheats, and utilities for games including Roblox, Fortnite, and Counter-Strike 2.

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/marsalek-malware-fake-game-cheats-password-theft/

Active from approximately December 2025 through May 2026, Marsalek offered free access to sophisticated information-stealing malware through a publicly accessible platform, complete with a dashboard that allowed users to create malicious files, track victims, and access stolen information. McAfee Labs identified more than 1,560 registered accounts, over 400 malicious files, and more than 29 distribution URLs associated with the campaign, illustrating the accessibility and potential reach of these operations.

Our investigation also uncovered a particularly concerning tactic known as a dual-hook infection. This occurs when a single malware infection uses two separate channels to collect and send stolen information, potentially allowing multiple cybercriminals to profit from the same victim. In Marsalek’s case, the malware deploys an additional information stealer called PureLog, which sends stolen data to a separate server. This means that while someone using Marsalek may believe they’re collecting stolen passwords and other personal information for themselves, the malware operator could also gain access to that information without their knowledge.

Like WeedHack, Marsalek highlights a troubling shift in the cybercrime landscape: powerful malware tools are becoming easier to obtain and operate, lowering the barriers for inexperienced users to engage in cybercrime. For unsuspecting gamers and everyday internet users, the consequences can be serious. Downloading what appears to be a free game modification or useful application could expose saved passwords, online accounts, cryptocurrency wallets, and sensitive personal files to cybercriminals.

 

[Bot]

Hi Khushal, the dual-hook design is the most revealing part of this campaign. “Free” appears to mean that the Marsalek operator monetized the service by quietly receiving a second copy of the stolen data through PureLog. The inexperienced affiliate takes the risk of distributing malware while the operator can potentially exploit the most valuable accounts first—a suitably crooked arrangement even by MaaS standards.

A few scale distinctions matter:

• McAfee’s 1,560 registered accounts represent accounts on the Marsalek platform, not 1,560 confirmed victims.
• The 400 generated files and 29 distribution URLs demonstrate substantial infrastructure and reach, but do not establish an infection count.
• Although McAfee dates the observed operation to roughly December 2025–May 2026, previously downloaded payloads, repackaged copies and already-stolen credentials can remain dangerous. “Campaign inactive” does not make an old cheat installer safe.

The malware’s targeting is broader than gaming accounts. McAfee reports theft of browser passwords and cookies, Discord tokens, cryptocurrency-related browser-extension data and other application information. Stolen session cookies or tokens can sometimes bypass the usefulness of merely changing a password until existing sessions are revoked. If wallet seed material or private keys were exposed, changing the wallet password is also insufficient; assets should be moved to a newly generated wallet from a trusted device. The full technical analysis is in McAfee’s report.

For anyone who executed one of these supposed cheats, a negative antivirus scan alone should not be treated as proof that the system is clean. Disconnect it, avoid entering replacement credentials on it, and open a free Malware Removal Assistance case through Get help. From a separate trusted device, secure the primary email first, then revoke sessions and rotate important passwords for password managers, Discord, gaming accounts, exchanges and other financial services.

Sources

• Marsalek: Free Malware-as-a-Service Targets Gamers | McAfee Blog