Analysts at McAfee Labs have revealed details of a malware-as-a-service campaign called Marsalek, which between December 2025 and May 2026 used fake Minecraft clients, including Shadow Client, to steal passwords, browser cookies, and cryptocurrency wallet data. According to a report described by GBHackers, the operation registered more than 1,560 criminal accounts using the platform.

Malware as a service: anyone could build their own stealer

Marsalek operated on a malware-as-a-service model, meaning anyone interested could sign up on the operation's public site, configure their own malicious file, and track infected victims through a criminal dashboard. This model accelerated the campaign's growth: McAfee Labs counted more than 400 malicious files distributed from at least 29 different URLs over the platform's six months of activity.

The investigation covered the period from December 2025 to May 2026. The most infections were recorded in the United States, followed by Germany, the United Kingdom, India, and Brazil, which points to a global reach rather than a regional one.

A fake Shadow Client and other traps for players

The people behind Marsalek impersonated popular, unofficial Minecraft clients, including Shadow Client and Boss Client, promising players extra cheat-type features. According to GBHackers, infections happened through four variants of the first-stage attack: PowerShell scripts, fake CAPTCHA pages using the ClickFix technique, Python scripts, and PE executable files. Each of these installed a portable Python environment along with packages like cryptography and requests, then disabled Microsoft Defender by adding its own paths to the exclusion list.

The same mechanism was also used in campaigns impersonating Roblox, Fortnite, Counter-Strike 2, and Grim Dawn, confirming that Minecraft was just one of several popular titles used as bait on a wide scale.

What exactly Marsalek steals

The scope of stolen data is broad. The malware decrypts cookies, passwords, and v20-prefixed tokens using AES-GCM encryption, targeting Chromium-based browsers as well as Firefox.

  • 32 types of Chromium-based browsers and Firefox
  • 56 web browser extensions
  • 12 types of cryptocurrency wallets
  • Discord tokens, Telegram session data, and Mullvad VPN accounts

This range of permissions lets criminals not only steal Minecraft account passwords but also take over bank accounts linked to the browser, messaging apps, and the victim's cryptocurrency wallets, which makes Marsalek far more damaging than a typical virus that only steals game login credentials.

Minecraft as a recurring target for cybercriminals

Marsalek isn't the first campaign aimed at Minecraft players. Back in August 2026, McAfee Labs described the WeedHack campaign, in which fake client download sites, promoted through SEO poisoning, infected more than 116,000 players, with WebAdvisor blocking over 6,300 attempts to access malicious sites in a single month, according to CyberSecurityNews. Both campaigns show that the popularity of unofficial Minecraft clients and mods remains one of the most common infection routes, especially among younger players looking for a competitive edge.

How to protect yourself from fake clients

Security experts keep repeating the same advice: the game and its add-ons should only come from official sources, such as the launcher available through /pobierz/java or /pobierz/bedrock, while unofficial cheats and clients installed from Discord or links in YouTube comments should raise red flags no matter how professional the download page looks. If someone suspects they've downloaded an infected file, they should uninstall it, run a full antivirus scan, and change their passwords from a separate, clean device.

Safely modding the game is still possible through trusted channels, such as the directories described in our /mody section, where add-ons go through at least basic verification, unlike random links promising ready-made cheats or unofficial PvP clients.

Sources