Fake game cheats hide Marsalek malware that steals passwords and crypto wallet data
- Severity
- High
- Sources
- 1
What happened
Marsalek is a malware-as-a-service stealer spread through fake Roblox script executors, Minecraft clients and Counter-Strike 2 tools, using PowerShell, Python or EXE droppers and ClickFix pages that imitate Cloudflare. Stage 2 uses CMSTP to try for admin rights, hides the permission prompt, and adds 8 paths and 15 processes to Microsoft Defender exclusions. Stage 3 (svc.py) injects a DLL into suspended Chromium processes to get past App-Bound Encryption, and the final stage is PureLog. Defenders should hunt for the published SHA256 hashes, review Defender exclusions, and rotate credentials and wallets on any host that ran a suspicious cheat.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Download games and tools only from official sources.
- Never turn off antivirus because a site claims a file is a false alarm.
- Never paste commands from a web page into Windows.
- If a suspicious cheat was run, change passwords from a clean device, sign out of all sessions, move crypto to a new wallet, and reinstall Windows.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Companies
Products