Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies

Marsalek is a malware-as-a-service platform disguised as game cheats for titles like Roblox, Fortnite, CS2 and Minecraft that operated from December 2025 to May 2026, with >1,560 registered accounts, 400+ malicious files and 29+ distribution URLs. The report details multi-stage infection chains (PowerShell, Python, PE), a CMSTP UAC bypass, App-Bound Encryption abuse to decrypt browser secrets, a 1,400-line stealer (svc.py), and a final-stage PureLog stealer that exfiltrates data to a separate C2; it includes IOCs and defensive guidance (detect cmstp.exe /au, Defender exclusion changes, unexpected Python runtimes).