The Marsalek infostealer and the Yoba malware reach victims through downloads that people choose to run. One hides in fake game cheats, the other in fake ChatGPT and Claude desktop apps. McAfee Labs published its Marsalek analysis on 4 November 2026, and Check Point Research published its Yoba report on 27 October 2026. This playbook turns both write-ups into steps in order: block, hunt, respond.
How Does the Marsalek Infostealer Differ From Yoba?
| Campaign | Lure | What runs | What it takes or does | Researcher |
|---|---|---|---|---|
| Marsalek | Fake cheats and tools for Roblox, Fortnite, Counter-Strike 2, Minecraft and Grim Dawn, shared on fake sites and Discord | PowerShell, a ClickFix fake CAPTCHA page, Python or an executable, then Python stages and PureLog | Browser passwords and cookies, Discord tokens, Telegram sessions, crypto wallet data | McAfee Labs |
| Yoba | Fake GitHub projects offering “GPT-5.6 Sol”, “GPT-6 Astra” and “Claude Opus” desktop apps | A signed executable loads a malicious DLL, which fetches a payload | A cryptominer was observed, but the loader can deliver other payloads | Check Point Research |
McAfee says Marsalek was a free malware-as-a-service platform, active from mid-December 2025 to about the end of May 2026. It counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. McAfee links it to the earlier WeedHack campaign through a shared Telegram support handle.
McAfee also describes a dual-hook design. Marsalek drops the PureLog stealer, which sends stolen data to a separate server, so the platform owner may receive what its customers collect. For you, that means one infection can feed two criminals.
Check Point says it tracked Yoba for two months. The fake GitHub projects have GitHub.io pages and ZIP releases, and Check Point saw no inflated stars or forks. It says the pages still rank high in Google, most likely through SEO poisoning. Check Point states that indicators suggest Russian origins.
What Are the Steps to Block, Hunt and Respond?
Steps 1 to 5 reduce the chance of a run, steps 6 to 8 find what already ran, and steps 9 to 10 contain it. The detection details come from the two write-ups. The ordering and the control advice are ours.
- Block unapproved installersUse application control so executables and scripts from user-writable folders and downloads do not run. Both campaigns need a person to run a file the company never approved.
- Treat a valid signature as partial evidenceCheck Point describes the Yoba executables as legitimate and signed, with the malware in a DLL beside them. Alert when a signed application loads an unexpected DLL from a user-writable folder.
- Name the approved sources for AI appsPublish where staff may get AI desktop apps, and block GitHub release downloads and GitHub.io pages from accounts you have not approved.
- Close the paste-and-run routeMarsalek ClickFix pages imitate a CAPTCHA and run a PowerShell command. Restrict PowerShell for standard users and teach staff never to paste commands from a web page.
- Protect the endpoint toolsTurn on tamper protection and alert on every change to Defender exclusions. McAfee says Marsalek adds 8 excluded paths and 15 excluded processes.
- Hunt for the Yoba sideloadLook for winmm.dll beside a signed Setup.exe in user folders. Look for a ProgramData folder named WMProcess holding a copy of WMPDMC.exe. Look for a scheduled task authored as Microsoft Corporation with the description “Collects device metadata for Windows Media Player”, which Check Point says runs
- Hunt for the Marsalek chainLook for cmstp.exe started with an INF file from a temp folder. Look for a portable Python runtime and pip installs launched by PowerShell. Look for a browser started in a suspended state by a process that is not a browser. McAfee also reports a scheduled task that runs a look-alike of RuntimeBroker
- Hunt for miner side effectsCheck Point reports an XMRig miner injected into svchost.exe, a Tor bundle unpacked in a temp folder and DNS-over-HTTPS lookups to a public resolver. Look for those on hosts that are not browsers, and for sustained CPU use on idle machines.
- Isolate and rebuildIsolate the host and reimage it. Check Point says the Yoba loader can run any executable or PowerShell payload, so removing the miner proves nothing about what else arrived.
- Reset what the stealer could readAssume Marsalek took saved passwords, cookies, Discord tokens, Telegram sessions and wallet data. From a clean device, reset passwords and revoke active sessions and tokens. Move any crypto to a new wallet, since McAfee says it replaced Exodus and Atomic Wallet files with backdoored ones.
Why This Order, and What Does It Map To?
Blocking comes first because both campaigns depend on a person running a file. Hunting comes before the rest of the response because you need the scope: which hosts ran the files decides which accounts to reset. Resets come last because they only help once the infected device is out of the picture.
Our ATT&CK reading of the steps is T1574.002 for the DLL sideload and T1548.002 for the CMSTP prompt bypass. We map T1562.001 to the Defender exclusions, T1053.005 to the scheduled tasks and T1555.003 to the browser credential theft. The mapping is ours, not the researchers’.
Cookies and tokens matter most for defenders, because a stolen session can skip the password and MFA prompt. Our page on ClickFix explains the paste-and-run lure. Our guide on how to respond to stealer log exposure covers the account side. The entries on infostealers and stealer logs explain what the stolen data is used for.