Beware! Cybercriminals Target Roblox Players with Fake Xeno Installer

Cybersecurity researchers have uncovered a malware campaign that targets Roblox players through fake versions of the popular Xeno Executor tool. The campaign tricks users into downloading a malicious installer that can steal personal information and give attackers remote access to infected devices.

According to cybersecurity firm Bitdefender, the campaign has been active since the beginning of the year. It saw a sharp increase in activity during March before stabilizing in recent months.

Beware! Cybercriminals Target Roblox Players with Fake Xeno Installer

Xeno Executor is a well-known third-party utility used by some Roblox players to run scripts, automate tasks, and use custom game modifications. Since Roblox regularly blocks unofficial tools, attackers take advantage of players searching for new “undetected” versions that can bypass the platform’s security measures.

Researchers found that cybercriminals promote the fake Xeno installer through gaming forums, Discord communities, and compromised or fake social media accounts. They advertise it as a working version that Roblox cannot detect, making it attractive to users looking for cheats or automation tools.

Victims download ZIP files or self-extracting archives that appear legitimate. To make the fake software look authentic, attackers copy the folder structure of the real Xeno Executor, include genuine Lua scripts, and use convincing file names.

However, when users launch the fake xeno.exe file, they unknowingly activate malware instead of the intended tool. The malicious program first checks whether Java is available on the computer and installs it if needed. It then connects to the attackers’ command-and-control server before downloading the final malware payload.

The final malware combines the functions of a remote access trojan (RAT) and an information stealer. It can collect browser cookies, saved passwords, and other stored data from browsers such as Chrome, Microsoft Edge, Brave, Opera, and Vivaldi.

See Also: Roblox Will Now Require Facial Age Verification for Chat

The malware also targets online accounts and payment information linked to services including Discord, Roblox, Minecraft, and Microsoft Store. In addition, it searches for cryptocurrency wallets, including Exodus Wallet, to steal digital assets.

Beyond stealing data, the malware can monitor users by recording keystrokes, tracking mouse activity, capturing screenshots, streaming the desktop, and even accessing the device’s webcam. It also gives attackers full remote control, allowing them to upload or download files, run PowerShell commands, and access a remote command shell.

Bitdefender believes this campaign is an updated version of the previously identified “Powercat” malware, featuring enhanced capabilities and a new command-and-control infrastructure.

Security experts advise Roblox players to avoid downloading third-party tools from untrusted websites or online communities. Installing software only from official and trusted sources remains the best way to protect devices and personal information from malware attacks.