[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSOgxYEEtmsMEufsJKC7MTnqNgDDErST2GjVSyoOOlSM":3},{"article":4,"iocs":47,"watch_terms":61,"solutions":62,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"91aac575-7902-4cb5-8b9e-c5c1d91b023e","Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data","hackers-hide-marsalek-malware-in-fake-roblox-and-fortnite-cheats-to-steal-passwo-03a60d","Hackers are hiding a free information stealer called Marsalek inside fake cheats and tools for games such as Roblox, Fortnite, and Counter-Strike 2. The files look like helpful game add-ons. In the background they steal saved passwords, browser cookies, Discord tokens, and crypto wallet data from Windows PCs. Marsalek ran from about December 2025 to […] The post Hackers Hide Marsalek Malware in Fake Roblox and Fortnite Cheats to Steal Passwords and Crypto Wallet Data appeared first on Cyber Security News.","Hackers distributed Marsalek, an information stealer malware, disguised as cheats for Roblox, Fortnite, and Counter-Strike 2 from December 2025 to May 2026. The malware-as-a-service operation registered over 1,560 accounts and created 400+ malicious files, stealing passwords, browser cookies, Discord tokens, and cryptocurrency wallet data from Windows PCs. McAfee Labs linked Marsalek to WeedHack and identified distribution through fake websites, Discord, GitHub, and other channels targeting primarily US, German, UK, Indian, and Brazilian users.","Marsalek malware distributed via fake game cheats steals passwords, cookies, and crypto wallet data.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-hide-marsalek-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Hide-Marsalek-Malware-in-Fake-Roblox-and-Fortnite-Cheats-to-Steal-Passwords-and-Crypto-Wallet-Data.webp","2026-11-05T10:59:30+00:00","2026-11-05T11:00:34.752629+00:00",9,[17,20,22,25,27],{"name":18,"type":19},"McAfee","vendor",{"name":21,"type":19},"Bitdefender",{"name":23,"type":24},"Roblox","product",{"name":26,"type":24},"Fortnite",{"name":28,"type":24},"Counter-Strike 2","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55,58],{"type":49,"value":50,"context":51},"domain","telemetrydata.to","C2 server used by PureLog stealer component for exfiltration",{"type":33,"value":53,"context":54},"Marsalek","Information stealer distributed as fake game cheats",{"type":33,"value":56,"context":57},"PureLog","Low-cost stealer used as final-stage payload in Marsalek chain",{"type":33,"value":59,"context":60},"WeedHack","Minecraft-focused service linked to Marsalek via shared Telegram support channel",[18,21,23],{"controls":63,"vendors":146},[64,93,121],{"slug":65,"name":66,"problem":67,"products":68},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":115,"vendor_name":21,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":122,"name":123,"problem":124,"products":125},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[126,133,140],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":122,"product_name":130,"url":131,"description":132},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":137,"url":138,"description":139},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":141,"product_name":142,"url":144,"description":145},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":159},"marsalek-infostealer-hides-in-fake-game-cheats-to-steal-credentials-and-crypto","Marsalek Infostealer Hides in Fake Game Cheats to Steal Credentials and Crypto","Hackers exploited the appeal of game cheats to distribute Marsalek, a malware-as-a-service infostealer, through fake websites, Discord, and GitHub — platforms users often trust uncritically. Victims who downloaded and executed the fake cheat tools handed attackers access to passwords, browser cookies, Discord tokens, and cryptocurrency wallet data. This campaign demonstrates how social engineering through gaming culture bypasses traditional threat instincts, particularly among younger or less security-aware users. The scale of the operation — 1,560+ registered accounts and 400+ malicious files — highlights how low-cost MaaS platforms dramatically amplify attacker reach. Organizations and individuals must recognize that unofficial software downloads from non-vetted sources represent a significant credential and financial theft risk.",[152,153,154,155,156,157,158],"CIS Control 14: Security Awareness and Skills Training","CIS Control 10: Malware Defenses","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","GDPR Article 32",{"GDPR Article 32":160,"MITRE ATT&CK T1566: Phishing":161,"CIS Control 10: Malware Defenses":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":164,"CIS Control 14: Security Awareness and Skills Training":165,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":166},"For organizations whose employees were compromised, the exfiltration of passwords and session cookies may constitute a personal data breach requiring technical safeguards — such as endpoint controls and MFA — that GDPR Article 32 mandates as appropriate security measures.","Marsalek was distributed via fake websites, Discord messages, and GitHub repos acting as lures — a classic social engineering delivery mechanism that maps directly to phishing and spearphishing via service sub-techniques.","Deploying and maintaining anti-malware and EDR tools configured to detect infostealer behaviors — such as credential harvesting and browser data access — would have detected or blocked Marsalek execution on victim machines.","Victims running unmanaged or personal devices without up-to-date endpoint security left exploitable gaps; systematic endpoint hardening and software integrity controls would reduce the attack surface for infostealer deployment.","The success of this campaign relied on victims lacking the competence to identify malicious software disguised as game utilities; organizations must ensure users are trained to recognize and respond to social engineering through non-traditional channels.","Users were socially engineered into downloading malware disguised as game cheats; a structured awareness program teaching users to distrust unofficial software downloads and social-platform file sharing would directly reduce this attack vector.","Stolen passwords and browser cookies were the primary goal of this campaign; enforcing MFA across all sensitive accounts would have rendered harvested credentials far less actionable for attackers."]