A malware-as-a-service operation known as Marsalek offered hackers a free password stealer, but it also sent every victim's data to the creator of the kit. Both campaigns are associated with the same Telegram support channel, "@MetaMaskenMann." McAfee identified over 1,560 registered accounts, more than 400 malicious files, and over 29 distribution URLs.
The free tier required no Discord or email accounts, while the premium tier was set to “coming soon.” Marsalek Stealer betrayed hackers by providing customers with a dashboard.
They could create PowerShell, Python, EXE, and ClickFix payloads, track victims on a heatmap, and read stolen data. If you suspect you've been infected, change your passwords, revoke active sessions, and move crypto funds to a new wallet. Mcafee advised.
Indicators of Compromise Stage SHA256 File name Stage 1 c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97 Fake CAPTCHA page Stage 1 98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4 Restructure within authorized threat intelligence systems like MISP, VirusTotal, or your SIEM.
Collaborate with 16,000+ SOC teams using ANY.RUN to expedite threat investigations and decrease manual workload.
