Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data
Marsalek malware distributed via fake game cheats steals passwords, cookies, and crypto wallet data.
Hackers distributed Marsalek, an information stealer malware, disguised as cheats for Roblox, Fortnite, and Counter-Strike 2 from December 2025 to May 2026. The malware-as-a-service operation registered over 1,560 accounts and created 400+ malicious files, stealing passwords, browser cookies, Discord tokens, and cryptocurrency wallet data from Windows PCs. McAfee Labs linked Marsalek to WeedHack and identified distribution through fake websites, Discord, GitHub, and other channels targeting primarily US, German, UK, Indian, and Brazilian users.
AI summary of the linked source. Not reviewed by an editor. How this works
Run McAfee?
Get an email when a new story names McAfee, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHackers exploited the appeal of game cheats to distribute Marsalek, a malware-as-a-service infostealer, through fake websites, Discord, and GitHub — platforms users often trust uncritically. Victims who downloaded and executed the fake cheat tools handed attackers access to passwords, browser cookies, Discord tokens, and cryptocurrency wallet data. This campaign demonstrates how social engineering through gaming culture bypasses traditional threat instincts, particularly among younger or less security-aware users. The scale of the operation — 1,560+ registered accounts and 400+ malicious files — highlights how low-cost MaaS platforms dramatically amplify attacker reach. Organizations and individuals must recognize that unofficial software downloads from non-vetted sources represent a significant credential and financial theft risk.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — telemetrydata.to
- malware — Marsalek
- malware — PureLog
- malware — WeedHack