Roblox Players Lured by Fake Xeno Script Launcher, Infected with Malware
A malicious campaign has been targeting Roblox players since the start of this year, with a fake version of the popular script launcher tool, Xeno Executor, spreading malware that steals sensitive information and grants remote access to attackers. Cybersecurity researchers at Bitdefender have discovered the scheme, which has been ongoing despite attempts by Roblox to block unauthorized versions.
The attack works by promoting the fake Xeno installation through gaming forums, Discord communities, or compromised accounts. Victims are tricked into downloading ZIP archives containing the malware, which is disguised as an “undetected” version of Xeno. Once launched, the malware loader extracts a Java payload that checks for the presence of a Java Runtime Environment and then connects to the attackers’ command-and-control server.
The final payload is a Java-based Remote Access Tool (RAT) and information stealer that can extract credentials from various online accounts, including Roblox, Minecraft, and Microsoft Store. It also steals cryptocurrency wallet data and provides surveillance capabilities such as keylogging and desktop streaming. The malware allows attackers to upload and download files, execute PowerShell commands, and access an interactive remote shell.
The campaign is believed by Bitdefender to be the same as the “Powercat” scheme documented earlier this year, but with significant updates to the malware’s capabilities and a new command-and-control infrastructure. This suggests that the attackers are continuously evolving their tactics to evade detection.
To avoid falling victim to this scam, Roblox players should exercise caution when installing third-party tools from unknown sources. Bitdefender recommends avoiding such installations altogether and instead opting for official Roblox scripts or tools. By being vigilant and taking proactive measures, users can protect themselves against these types of threats.
The discovery of this campaign serves as a reminder that even seemingly legitimate software can be compromised by malicious actors. It’s essential for users to verify the authenticity of any tool or script they plan to install, especially when it comes to online gaming platforms like Roblox. By staying informed and taking necessary precautions, we can reduce the risk of falling prey to these types of attacks.
As a security-conscious individual, it’s crucial to be aware of the tactics used by attackers and take proactive steps to protect yourself. Regularly updating your software, using strong passwords, and being cautious when downloading files from unknown sources are all essential habits to cultivate. By doing so, you can minimize the risk of falling victim to these types of attacks and enjoy a safer online experience.
Source: Bleeping Computer — 2026-08-03