Fake Roblox Cheat Tool Hiding Dangerous RAT and Infostealer Malware

Key points

Security researchers at Bitdefender have uncovered a malicious campaign spreading a fake version of the Xeno Executor mod to Roblox players ¹.
The malware package combines a Java-based Remote Access Trojan (RAT) and an information stealer designed to harvest browser data, payment details, and crypto wallets ¹.
Once installed, the payload gives attackers extensive surveillance powers including webcam access, keystroke logging, desktop streaming, and PowerShell command execution ¹.
The malicious campaign first launched at the beginning of the year, peaked in March 2026, and continues to pose a threat to the platform's 82 million active players ¹.

The Trap Behind the Mod

Cybercriminals have found a lucrative new vector for malware distribution by exploiting the desires of gamers looking for shortcuts. In this latest campaign uncovered by security researchers, attackers have been promoting a fraudulent version of Xeno Executor across gaming forums, Discord servers, and other online communities ¹. While Xeno Executor is an unofficial utility used by some players to run custom scripts and automated cheats on Roblox, Roblox regularly blocks these unauthorized tools with anti-cheat updates.

To bypass these safeguards, the scammers advertised their malicious download as an “undetected” and “invisible” modification capable of evading anti-cheat detection ¹. Instead of granting players an unfair advantage in their favorite virtual worlds, downloading the file triggers a sophisticated infection chain that compromises the user’s entire machine ¹.

Comprehensive System Compromise

Once the deceptive script is executed, it deploys a dangerous combination of a Java-based Remote Access Trojan and an aggressive information-stealing payload ¹. The malware immediately begins harvesting sensitive personal data, stripping login credentials, cookies, and saved passwords from major web browsers including Chrome, Edge, Brave, Opera, and Vivaldi ¹.

The threat doesn’t stop at browser history. The infostealer actively targets credentials and tokens for online accounts across platforms like Discord, Roblox, Minecraft, and the Microsoft Store, alongside stored payment details ¹. Cryptocurrency enthusiasts face a particularly severe risk, as the malware specifically hunts down and extracts digital asset data from Exodus wallets ¹.

Total Remote Surveillance

Beyond simple data theft, the RAT component transforms the victim’s computer into an open book for the attackers. The software enables complete remote surveillance, giving perpetrators the ability to log keystrokes, track mouse movements, capture screenshots, and live-stream desktop activity ¹.

Most alarming for user privacy, the malware can tap directly into connected webcams, allowing bad actors to watch users through their own hardware ¹. The infection also equips operators with advanced system-level capabilities, including file upload and download functionalities and the execution of PowerShell commands, handing over virtually unrestricted control of the compromised PC ¹.

An Ongoing Threat

While the exact number of victims remains difficult to quantify, the scale of the potential target pool is immense. Roblox boasts more than 82 million active players, making even a small conversion rate highly lucrative for the operators behind the scheme ¹.

According to security telemetry, the campaign kicked off at the start of the year and reached a high-volume peak in March 2026 ¹. Although the initial surge has since leveled off, researchers warn that the operation remains active and continues to pose a steady threat to unsuspecting gamers looking for easy shortcuts ¹.

Companies mentioned: Microsoft

Primary sources

New malware disguised as popular Roblox cheat tool could give hackers full control of your PC — including the webcam (techradar.com) – Bitdefender discovered a malicious campaign targeting Roblox players by disguising a Java-based RAT and infostealer as an invisible version of the Xeno Executor cheat tool, enabling full remote control, data theft, and webcam surveillance.

Fake Roblox Cheat Tool Hiding Dangerous RAT and Infostealer Malware