Marsalek Malware-as-a-Service Hidden in Fake Roblox, Minecraft and Fortnite Cheats Delivers PureLog Stealer

Key facts for Marsalek MaaS infostealer

Detection coverage for Marsalek MaaS infostealer

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5393 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Marsalek CMSTP INF UAC Bypass from User-Writable Path (T1218.003)

Behaviour-first detection of cmstp.exe run with a silent flag (/au, /s, /ni) and an INF file from Temp, AppData or Public, the Marsalek Stage 2 python_setup.py elevation (T1218.003, T1548.002) that precedes the WinDefConfig.cmd Defender exclusions. The same technique is shared with the WeedHack MaaS (TL-2026-5393).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1218.003, T1548.002, T1562.001
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\cmstp.exe" OR OriginalFileName="CMSTP.EXE") CommandLine="*.inf*" (CommandLine="* /au *" OR CommandLine="* /s *" OR CommandLine="* /ni *") (CommandLine="*\\Temp\\*" OR CommandLine="*\\AppData\\*" OR CommandLine="*\\Users\\Public\\*") | eval threat="TL-2026-5393 Marsalek CMSTP UAC bypass" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parents by host, User, threat | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cmstp.exe"
| where ProcessCommandLine has ".inf"
| where ProcessCommandLine matches regex @"(?i)\s/(au|s|ni)\b"
| where ProcessCommandLine has_any ("\\Temp\\", "\\AppData\\", "\\Users\\Public\\")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: Marsalek CMSTP INF UAC Bypass from User-Writable Path
id: c4e8a1d7-2b93-4f06-8d5a-61f0b7e39c12
status: experimental
description: Detects cmstp.exe launched with a silent-install flag and an INF file from a temp or user-writable folder, the Marsalek Stage 2 (python_setup.py) UAC bypass also used by WeedHack.
references:
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/marsalek-malware-fake-game-cheats-password-theft/
    - https://attack.mitre.org/techniques/T1218/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1548.002
    - attack.t1218.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmstp.exe'
        - OriginalFileName: 'CMSTP.EXE'
    selection_inf:
        CommandLine|contains: '.inf'
    selection_flags:
        CommandLine|contains:
            - ' /au '
            - ' /s '
            - ' /ni '
    selection_path:
        CommandLine|contains:
            - '\Temp\'
            - '\AppData\'
            - '\Users\Public\'
    condition: selection_img and selection_inf and selection_flags and selection_path
falsepositives:
    - Legitimate VPN/connection-manager profile installs by IT using CMSTP from a staging folder
level: high

Known false positives:

• IT-managed deployment of VPN connection profiles via cmstp.exe with an INF staged in a temp folder
• Software installers that call cmstp.exe with a bundled INF extracted to AppData

Tuning notes: Allowlist signed deployment tooling by ParentImage or User, and scope to non-admin workstations. Sysmon EventCode 1 must be enabled with CommandLine capture. Consider adding a join to Defender exclusion changes within 5 minutes for a higher-fidelity alert.

• 🔒 Marsalek Stage 1 ClickFix PowerShell Cradle and VBS Lure · unlock with TL Creds
• 🔒 Marsalek PureLog RunetimeBroker Scheduled Task and Startup Persistence · unlock with TL Creds
• 🔒 Marsalek Lure Site and Script Payload Staging Connections · unlock with TL Creds
• 🔒 Marsalek Portable Python Stealer Staging and Fake Cheat Lure Execution · unlock with TL Creds
• 🔒 Marsalek Chrome App-Bound Encryption Bypass via Browser Process Injection · unlock with TL Creds
• 🔒 Marsalek Python Stealer Exfiltration to Telegram or Discord · unlock with TL Creds
• 🔒 Marsalek Defender Exclusion Tampering via [indicator] · unlock with TL Creds
• 🔒 Marsalek / PureLog C2 and Payload Infrastructure Contact · unlock with TL Creds

Indicators of compromise for Marsalek MaaS infostealer

As of 2026-11-06, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-5393.

Sample indicators (3 of 41)

• IP address: 130.12.180[.]43
• Domain: telemetrydata[.]to
• URL: hxxp://solaraexecutor[.]online/solara.zip

Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.

Community OSINT corroboration for Marsalek MaaS infostealer

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Marsalek MaaS infostealer works

Marsalek is a malware-as-a-service (MaaS) with open, free sign-up that, per McAfee Labs research (published 2026-11-04 and reported by secondary outlets on 2026-11-05/06), operated from mid-December 2025 to about the end of May 2026. The service reportedly had 1,560+ registered accounts, generated 400+ malicious files and used 29+ distribution URLs. Primary targeted geographies are the United States, Germany, the United Kingdom, India and Brazil. Customers could build PowerShell, Python, EXE and ClickFix payloads, track victims on a heatmap and read stolen data from a panel. Builds were distributed disguised as game cheats and tools for Roblox (Swift, Solara, MatrixHub External, Matcha External), Minecraft (Shadow Client, Boss Client), Fortnite (Fortnite_tweaks.exe), Counter-Strike 2 (trigger bots), Grim Dawn and Discord (Discord Free Nitro Gen.exe) via look-alike websites, Discord, GitHub repositories, catbox.moe and filepost.dev hosting.

Stage 1 (initial execution) uses fake cheat executables (e.g. build_1280.exe, build_1505.exe), PowerShell scripts, ClickFix fake-CAPTCHA pages, Python files and VBS scripts. Stage 2 deploys a portable Python runtime (with cryptography and requests packages, pip-installed via PowerShell) and runs python_setup.py, which exploits CMSTP (cmstp.exe launched with an INF file from a temp folder, with silent prompt suppression) to obtain administrator rights, creates WinDefConfig.cmd to add 8 paths and 15 processes to Windows Defender exclusions, and downloads further payloads (including an AsyncRAT.py sample). The CMSTP UAC-bypass technique is the same one used by the related WeedHack service. Stage 3 is the svc.py stealer (~1,400 lines) that targets 32 Chromium browsers and Firefox, harvests passwords, cookies and Discord tokens, bypasses Chrome App-Bound Encryption by injecting a DLL into suspended browser processes (a browser started in a suspended state by a non-browser process is a hunting artifact), copies Telegram session data and Mullvad VPN details, scans 26 Discord paths, 56 browser extensions and 12 wallet applications, searches for files containing terms such as seed, passphrase and wallet, and backdoors Exodus and Atomic Wallet by replacing their .asar files.

Stage 4 delivers the commercial PureLog stealer (reported at a minimum of $59/month), which targets 35 browsers, 48 extensions and 12 desktop applications, is obfuscated with .NET Reactor, is encrypted with Triple DES and GZIP, runs in memory, and persists through a scheduled task (look-alike of RuntimeBroker) that runs RunetimeBroker.exe every 5 minutes; Startup-folder persistence is also reported. PureLog reports to a separate server (reported as telemetrydata.to), giving a dual-hook architecture: the operator receives a copy of stolen data collected by paying or free customers and may monetize high-value accounts first. Operator FAQ material gives guidance on using stolen cookies and tokens and on handling cryptocurrency (Monero). The Telegram support handle @MetaMaskenMann is shared with the WeedHack Minecraft MaaS (discovered by McAfee Labs 2026-06-02, 116,000+ infected PCs), and marsalek.cy is reported as shared with WeedHack. McAfee detection names: Trojan:Win/Marsalek.AB and Trojan:Script/Marsalek.AA.

No CVE is involved and no named threat actor is attributed. Severity is analyst-assigned. Caveat: the McAfee Labs primary report (linked from the source article) timed out on fetch and was not read directly; facts are corroborated across several secondary outlets (Cyber Security News, GBHackers, CyberPress, Brandefense). BeaconBeagle was unreachable (HTTP 502) at research time.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.003 CMSTP; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

Command and Control

T1219 Remote Access Tools

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Privilege Escalation

T1548.002 Bypass User Account Control

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation for Marsalek MaaS infostealer

Immediate actions

• Block marsalek.cy, telemetrydata.to, huehnchenfarm.ru and 130.12.180.43 at DNS, proxy and firewall
• Hunt for the listed SHA256 hashes, WinDefConfig.cmd, and a scheduled task launching RunetimeBroker.exe every 5 minutes
• Audit Windows Defender exclusion paths and processes for unauthorized additions
• On confirmed infection: change passwords from a clean device, sign out of all sessions, revoke Discord/Telegram sessions and tokens, move crypto to a new wallet, and reinstall Windows

Workarounds

• Download games and tools only from official sources and never disable antivirus based on site claims
• Restrict PowerShell with Constrained Language Mode and script block logging where feasible

Longer-term hardening

• Restrict execution of unsigned executables, Python and VBS from user-writable and download paths
• Enable Defender tamper protection and alert on exclusion changes
• Monitor cmstp.exe execution with INF files from temp folders and browsers launched suspended by non-browser processes
• Train users not to paste commands from web pages (ClickFix) and not to run game cheats or cracked tools

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints where users run the malicious cheat/tool downloads
• Google — Chrome and Chromium-based browsers (App-Bound Encryption bypassed)
  Vulnerable versions: Chromium browsers with App-Bound Encryption on Windows

Timeline of Marsalek MaaS infostealer

Last updated 2026-11-06 · revalidated 1× · latest source

• 2025-12-15 locked-ioc-40 MaaS begins operating (mid-December 2025 per McAfee Labs coverage; exact day not stated, 15th used as midpoint)
• 2026-05-31 locked-ioc-40 MaaS operation ends (about the end of May 2026; exact day not stated) after 1,560+ registered accounts, 400+ malicious files and 29+ distribution URLs
• 2026-06-02 McAfee Labs discovery of the related WeedHack Minecraft MaaS (116,000+ infected PCs, 3,820+ malicious JARs) is reported; it shares CMSTP UAC-bypass technique, the locked-ioc-32 Telegram support handle and reportedly the locked-ioc-37 domain
• 2026-08-24 The Hacker News and Security Affairs report continued distribution of the related WeedHack MaaS via SEO-poisoned fake Minecraft client sites after a C2 takedown; WeedHack shares locked-ioc-40's Telegram handle and final-stage payloads.
• 2026-11-04 McAfee Labs publishes its locked-ioc-40 analysis detailing the four-stage chain, CMSTP elevation, Chrome App-Bound Encryption bypass and PureLog final stage, with SHA256 IOCs
• 2026-11-05 31 SHA256 hashes across four stages, domains locked-ioc-37, locked-ioc-27 and locked-ioc-28, and distribution URLs published in coverage
• 2026-11-05 Cyber Security News, GBHackers and CyberPress report the McAfee Labs research; detection names locked-ioc-25 and locked-ioc-24 cited
• 2026-11-06 Threat added to Threadlinqs platform for tracking; McAfee primary page timed out on fetch and was not read directly

Update history

• 2026-11-06 — locked-ioc-40 Infostealer (MaaS) Spread via Fake Game Cheats Targeting Browser Credentials and Crypto Wallets: What changed No severity, exploitability or status change. Additive detail only. New indicators (5) Indicator values are withheld at this access level. New MITRE (3) Added T1620 (Reflective Code Loading), T1041 (Exfiltration Over C2 Channel

Sources cited for Marsalek MaaS infostealer

• McAfee Labs: Marsalek malware - fake game cheats and password theft mcafee.com · Vendor report · 2026-11-04
• Brandefense: Marsalek Infostealer and Yoba Playbook brandefense.io · Research
• McAfee: Scam Alert - Fake Minecraft, Roblox Hacks on YouTube Hide Malware, Target Kids mcafee.com · Vendor report
• Bitdefender: Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums bitdefender.com · Research
• MITRE ATT&CK T1218.003 - System Binary Proxy Execution: CMSTP MITRE · Research
• Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data cybersecuritynews.com · News · 2026-11-05
• GBHackers: Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies gbhackers.com · News · 2026-11-05
• CyberPress: Free Marsalek Malware Kit Secretly Sends Stolen Passwords to Its Creator and Other Hackers cyberpress.org · News · 2026-11-05
• WeedHack Minecraft malware campaign infects over 116,000 PCs (related MaaS, shared Telegram support handle) cyberinsider.com · News · 2026-06-02
• BleepingComputer: Fake Roblox Xeno script launcher pushes infostealer, RAT malware BleepingComputer · News

More in malware

• Armorsteal: Python Malware Kit Delivered via SEO-Poisoned Fake Download Pages Steals Data and Mines Crypto
• Infostealers in Banking Fraud: Stolen Credentials and Session Cookies Enable Silent Intrusions (Lumma, RisePro, METAStealer, Phantom Stealer)
• laZzzy Donut: Multi-Stage Loader Chain (Kramer-obfuscated Python, Donut shellcode, laZzzy loader)
• BTMob Android RAT: February 2026 Source Code Leak Expands Access and Resale
• Malicious Browser Extensions Ecosystem: Needle and Lunex Malware, Clean-Then-Update Extension Campaigns