# Marsalek Malware-as-a-Service Hidden in Fake Roblox, Minecraft and Fortnite Cheats Delivers PureLog Stealer

> Marsalek is a free malware-as-a-service operation (mid-December 2025 to May 2026) distributed through fake game cheats on look-alike sites, Discord and GitHub. A four-stage chain using PowerShell, ClickFix, Python and EXE payloads abuses CMSTP for elevation, adds Windows Defender exclusions, bypasses Chrome App-Bound Encryption and ends with the PureLog stealer to steal browser credentials, Discord/Telegram data and crypto wallets.

- **Published:** 2026-11-06T08:42:13Z
- **Last reviewed:** 2026-11-06T10:05:29.470Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5393
- **ID:** TL-2026-5393
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 41 (3 shown free below)

## Description

Marsalek is a malware-as-a-service (MaaS) with open, free sign-up that, per McAfee Labs research (published 2026-11-04 and reported by secondary outlets on 2026-11-05/06), operated from mid-December 2025 to about the end of May 2026. The service reportedly had 1,560+ registered accounts, generated 400+ malicious files and used 29+ distribution URLs. Primary targeted geographies are the United States, Germany, the United Kingdom, India and Brazil. Customers could build PowerShell, Python, EXE and ClickFix payloads, track victims on a heatmap and read stolen data from a panel. Builds were distributed disguised as game cheats and tools for Roblox (Swift, Solara, MatrixHub External, Matcha External), Minecraft (Shadow Client, Boss Client), Fortnite (Fortnite_tweaks.exe), Counter-Strike 2 (trigger bots), Grim Dawn and Discord (Discord Free Nitro Gen.exe) via look-alike websites, Discord, GitHub repositories, catbox.moe and filepost.dev hosting.

Stage 1 (initial execution) uses fake cheat executables (e.g. build_1280.exe, build_1505.exe), PowerShell scripts, ClickFix fake-CAPTCHA pages, Python files and VBS scripts. Stage 2 deploys a portable Python runtime (with cryptography and requests packages, pip-installed via PowerShell) and runs python_setup.py, which exploits CMSTP (cmstp.exe launched with an INF file from a temp folder, with silent prompt suppression) to obtain administrator rights, creates WinDefConfig.cmd to add 8 paths and 15 processes to Windows Defender exclusions, and downloads further payloads (including an AsyncRAT.py sample). The CMSTP UAC-bypass technique is the same one used by the related WeedHack service. Stage 3 is the svc.py stealer (~1,400 lines) that targets 32 Chromium browsers and Firefox, harvests passwords, cookies and Discord tokens, bypasses Chrome App-Bound Encryption by injecting a DLL into suspended browser processes (a browser started in a suspended state by a non-browser process is a hunting artifact), copies Telegram session data and Mullvad VPN details, scans 26 Discord paths, 56 browser extensions and 12 wallet applications, searches for files containing terms such as seed, passphrase and wallet, and backdoors Exodus and Atomic Wallet by replacing their .asar files.

Stage 4 delivers the commercial PureLog stealer (reported at a minimum of $59/month), which targets 35 browsers, 48 extensions and 12 desktop applications, is obfuscated with .NET Reactor, is encrypted with Triple DES and GZIP, runs in memory, and persists through a scheduled task (look-alike of RuntimeBroker) that runs RunetimeBroker.exe every 5 minutes; Startup-folder persistence is also reported. PureLog reports to a separate server (reported as telemetrydata.to), giving a dual-hook architecture: the operator receives a copy of stolen data collected by paying or free customers and may monetize high-value accounts first. Operator FAQ material gives guidance on using stolen cookies and tokens and on handling cryptocurrency (Monero). The Telegram support handle @MetaMaskenMann is shared with the WeedHack Minecraft MaaS (discovered by McAfee Labs 2026-06-02, 116,000+ infected PCs), and marsalek.cy is reported as shared with WeedHack. McAfee detection names: Trojan:Win/Marsalek.AB and Trojan:Script/Marsalek.AA.

No CVE is involved and no named threat actor is attributed. Severity is analyst-assigned. Caveat: the McAfee Labs primary report (linked from the source article) timed out on fetch and was not read directly; facts are corroborated across several secondary outlets (Cyber Security News, GBHackers, CyberPress, Brandefense). BeaconBeagle was unreachable (HTTP 502) at research time.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1218.003 CMSTP
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1620 Reflective Code Loading
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Marsalek CMSTP INF UAC Bypass from User-Writable Path (T1218.003)** (`TL-2026-5393-SPL-001`)

Behaviour-first detection of cmstp.exe run with a silent flag (/au, /s, /ni) and an INF file from Temp, AppData or Public, the Marsalek Stage 2 python_setup.py elevation (T1218.003, T1548.002) that precedes the WinDefConfig.cmd Defender exclusions. The same technique is shared with the WeedHack MaaS (TL-2026-5393).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.003, T1548.002, T1562.001
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\cmstp.exe" OR OriginalFileName="CMSTP.EXE") CommandLine="*.inf*" (CommandLine="* /au *" OR CommandLine="* /s *" OR CommandLine="* /ni *") (CommandLine="*\\Temp\\*" OR CommandLine="*\\AppData\\*" OR CommandLine="*\\Users\\Public\\*") | eval threat="TL-2026-5393 Marsalek CMSTP UAC bypass" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parents by host, User, threat | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cmstp.exe"
| where ProcessCommandLine has ".inf"
| where ProcessCommandLine matches regex @"(?i)\s/(au|s|ni)\b"
| where ProcessCommandLine has_any ("\\Temp\\", "\\AppData\\", "\\Users\\Public\\")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Marsalek CMSTP INF UAC Bypass from User-Writable Path
id: c4e8a1d7-2b93-4f06-8d5a-61f0b7e39c12
status: experimental
description: Detects cmstp.exe launched with a silent-install flag and an INF file from a temp or user-writable folder, the Marsalek Stage 2 (python_setup.py) UAC bypass also used by WeedHack.
references:
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/marsalek-malware-fake-game-cheats-password-theft/
    - https://attack.mitre.org/techniques/T1218/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.t1548.002
    - attack.t1218.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmstp.exe'
        - OriginalFileName: 'CMSTP.EXE'
    selection_inf:
        CommandLine|contains: '.inf'
    selection_flags:
        CommandLine|contains:
            - ' /au '
            - ' /s '
            - ' /ni '
    selection_path:
        CommandLine|contains:
            - '\Temp\'
            - '\AppData\'
            - '\Users\Public\'
    condition: selection_img and selection_inf and selection_flags and selection_path
falsepositives:
    - Legitimate VPN/connection-manager profile installs by IT using CMSTP from a staging folder
level: high

```

**Known false positives:**

- IT-managed deployment of VPN connection profiles via cmstp.exe with an INF staged in a temp folder
- Software installers that call cmstp.exe with a bundled INF extracted to AppData

**Tuning notes:** Allowlist signed deployment tooling by ParentImage or User, and scope to non-admin workstations. Sysmon EventCode 1 must be enabled with CommandLine capture. Consider adding a join to Defender exclusion changes within 5 minutes for a higher-fidelity alert.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Marsalek Stage 1 ClickFix PowerShell Cradle and VBS Lure (locked: unlock with TL Creds)
- Marsalek PureLog RunetimeBroker Scheduled Task and Startup Persistence (locked: unlock with TL Creds)
- Marsalek Lure Site and Script Payload Staging Connections (locked: unlock with TL Creds)
- Marsalek Portable Python Stealer Staging and Fake Cheat Lure Execution (locked: unlock with TL Creds)
- Marsalek Chrome App-Bound Encryption Bypass via Browser Process Injection (locked: unlock with TL Creds)
- Marsalek Python Stealer Exfiltration to Telegram or Discord (locked: unlock with TL Creds)
- Marsalek Defender Exclusion Tampering via [indicator] (locked: unlock with TL Creds)
- Marsalek / PureLog C2 and Payload Infrastructure Contact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 41)

Defanged, TLP:CLEAR.

- IP address: `130.12.180[.]43`
- Domain: `telemetrydata[.]to`
- URL: `hxxp://solaraexecutor[.]online/solara.zip`

Full set of 41 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data](https://cybersecuritynews.com/hackers-hide-marsalek-malware/)
- [McAfee Labs: Marsalek malware - fake game cheats and password theft](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/marsalek-malware-fake-game-cheats-password-theft/)
- [GBHackers: Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies](https://gbhackers.com/marsalek-infostealer/)
- [CyberPress: Free Marsalek Malware Kit Secretly Sends Stolen Passwords to Its Creator and Other Hackers](https://cyberpress.org/marsalek-stealer-betrays-hackers/)
- [Brandefense: Marsalek Infostealer and Yoba Playbook](https://brandefense.io/security-news/marsalek-infostealer-yoba-fake-apps-playbook/)
- [WeedHack Minecraft malware campaign infects over 116,000 PCs (related MaaS, shared Telegram support handle)](https://cyberinsider.com/weedhack-minecraft-malware-campaign-infects-over-116000-pcs/)
- [McAfee: Scam Alert - Fake Minecraft, Roblox Hacks on YouTube Hide Malware, Target Kids](https://www.mcafee.com/blogs/internet-security/scam-alert-fake-minecraft-roblox-hacks-on-youtube-hide-malware-target-kids/)
- [BleepingComputer: Fake Roblox Xeno script launcher pushes infostealer, RAT malware](https://www.bleepingcomputer.com/news/security/fake-roblox-xeno-script-launcher-pushes-infostealer-rat-malware/)
- [Bitdefender: Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums](https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor)
- [MITRE ATT&CK T1218.003 - System Binary Proxy Execution: CMSTP](https://attack.mitre.org/techniques/T1218/003/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5393