Roblox Players Targeted by Malicious Script Launcher Spreading Infostealer and RAT Malware
A sophisticated cyberattack campaign has been unfolding on the popular online gaming platform Roblox, preying on unsuspecting users with a fake script launcher that secretly installs infostealing malware and remote access tools (RATs). The malicious tool, masquerading as an “undetected” version of the legitimate Xeno Executor utility, is being promoted through gaming forums, Discord communities, and compromised accounts.
The campaign, which began to gain momentum in March, has been observed by cybersecurity researchers at Bitdefender. They discovered that the attackers are exploiting Roblox users’ desire for a script launcher that can evade the platform’s anti-cheat protections. The fake Xeno installers come packaged as ZIP archives or self-extracting files, complete with convincing directory structures and genuine Lua scripts to make them appear authentic.
When victims launch the malicious executable, they unwittingly run a first-stage malware loader that checks for Java Runtime Environment (JRE) installation on their system. If JRE is missing, it extracts and installs it before proceeding to read validation keys from a local file containing the attackers’ command-and-control (C2) server credentials.
The final payload, a Java-based RAT and information stealer, boasts an impressive range of capabilities. It can steal sensitive data from popular browsers like Chrome, Edge, Brave, Opera, and Vivaldi, as well as online accounts and payment information associated with platforms such as Discord, Roblox, Minecraft, Microsoft Store, and cryptocurrency wallets. The malware also provides surveillance capabilities, including keylogging, mouse activity logging, screenshot capturing, desktop streaming, and webcam access.
One of the most concerning aspects of this campaign is its apparent connection to a previously documented threat known as “Powercat.” Bitdefender believes that the same attackers are behind both campaigns, which have seen significant updates to their malware capabilities and C2 infrastructure. This continuous evolution underscores the importance for Roblox players to remain vigilant.
To avoid falling victim to this malicious script launcher, it is essential for users to exercise extreme caution when installing third-party tools on the platform. Bitdefender recommends completely avoiding such tools from obscure sources and instead opting for official Roblox scripts or those vetted by trusted developers.
Source: Bleeping Computer — 2026-08-03