Fake Roblox and Fortnite cheats hid a free password stealer called Marsalek
Fake cheats and tools for Roblox, Fortnite, Minecraft and Counter-Strike 2 were hiding a password stealer called Marsalek, according to a report McAfee Labs published on 4 November. The operation ran from mid-December 2025 until around the end of May 2026 and cost nothing to join: anyone could sign up on a public site, build an infected file and follow victims on a dashboard. McAfee counted more than 1,560 registered accounts, over 400 malicious files and more than 29 web addresses spreading them.
What the fake files take
The files posed as Roblox script executors, Minecraft clients, Fortnite tweaks and CS2 cheats, as well as Discord utilities and crypto apps. They spread through fake websites and Discord. One variant skipped the download altogether: a page dressed up as a Cloudflare CAPTCHA check ran a malicious PowerShell command.
Once running, Marsalek gets administrator rights by hiding the Windows permission prompt and pressing Enter on its own. It then adds exclusions to Microsoft Defender so that the next files are not scanned.
The theft itself is broad:
- Browsers: passwords and cookies from more than 32 Chromium-based browsers, including Chrome, Edge and Brave, where it gets around Chrome's App-Bound Encryption.
- Messengers: Discord tokens from 26 locations on disk and Telegram session data.
- Crypto: over 56 browser extensions and 12 wallet apps, plus backdoors planted in the Exodus and Atomic Wallet desktop apps.
- Other data: details of the Mullvad VPN account configured on the computer, and files from folders such as the desktop and Downloads that match words like "wallet" or "paypal".
Stolen sessions are the same prize that drove the Ukrainian case over 610,000 Roblox accounts. A session cookie can open an account without the password, and fake game downloads are a familiar way to get one, as with the fake GTA 6 sites that spread the Vidar stealer.
The free kit robbed its own users
Marsalek's customers were targets too. The last stage of every infection installs a second stealer, PureLog, which sends its data to a separate server. McAfee calls this a dual hook: a customer thinks the stolen logins are theirs alone, while the kit's author holds a copy and can use a valuable victim's accounts first.
A paid tier was only ever marked "coming soon", and McAfee says paying would not have helped, since the owner could shut the servers down at any time and leave with the data and the fees. The dashboard's built-in FAQ taught customers how to use stolen cookies and tokens and how to launder crypto through Monero.
McAfee links Marsalek to WeedHack, a similar service aimed at Minecraft players, because both send customers to the same Telegram support channel. Marsalek was seen most often in the United States, followed by Germany, the United Kingdom, India and Brazil.
What to check at home
McAfee lists the warning signs: an .exe shared by another user on Discord, a "cracked" version of a new game on a polished website, and any tool whose site says antivirus alerts are a mistake and should be switched off. If children play on the family computer, ask what they have installed recently.
If someone did run such a file, treat the computer as compromised:
- From a different, clean device, change passwords, starting with email.
- Sign out of all sessions in Discord, Telegram, Google and game accounts, because stolen cookies can keep working after a password change.
- Move any crypto to a new wallet created on a clean device.
- Reinstall Windows. The stealer changes Defender settings and sets up its own scheduled tasks, so deleting the file is not enough.
McAfee also warns that attackers sometimes contact victims directly, claiming to have their IP address or webcam. Children who get such a message should tell a parent or guardian and not follow the instructions.
