Back Broadcom

Marsalek - a Malware-as-a-Service operation

Broadcom • November 6, 2026

Marsalek emerged as a wide-reaching malware-as-a-service (MaaS) platform identified by McAfee Labs. Sharing a Telegram support handle and final payloads with the parallel WeedHack operation, Marsalek went beyond Minecraft by masquerading as legitimate utilities, cryptocurrency apps, and cheats for popular video games. The malware initiates infiltration through a number of delivery mechanisms—including Python, PowerShell, and ClickFix—differentiating its intermediate stages from WeedHack’s Java reliance. Once executed, it establishes system persistence, adds security exclusions, and bypasses browser protections through DLL injection. The software aggressively harvests sensitive files, browser credentials, VPN data, messaging tokens, and infiltrates dozens of cryptocurrency wallets.

Symantec protects you from this threat, identified by the following:

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Machine Learning-based

Observed domains/IPs are covered under security categories in all WebPulse enabled products

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Overlord RAT and Marsalek Malware Campaigns Target Users A WhatsApp phishing campaign has been identified, targeting Malaysian finance and business users with Overlord RAT, a remote access tool. The attack uses a ZIP archive masquerading as an account statement, containing a Microsoft-signed executable that side-loads an unsigned DLL. The malware employs advanced evasion techniques, including patching AMSI and ETW, and establishes persistence through a hidden folder. Separately, the Marsalek operation has emerged as a malware-as-a-service platform, distributing malware via Telegram and targeting various applications, including cryptocurrency wallets. Both threats are detected by Symantec's Carbon Black products, which block associated malicious indicators. Users are advised to implement strict malware execution policies to mitigate risks. 2 sources 54

Extracted Entities

Marsalek - a Malware-as-a-Service operation

The full story

Extracted Entities

Attack Types (1)

Malware (3)

MITRE ATT&CK (3)

Tools (2)