Fake Roblox Xeno Executor installs a RAT and infostealer

The popularity of unofficial gaming tools has again become a malware delivery channel. A campaign analysed by Bitdefender offers a supposedly “undetected” Xeno Executor—a launcher for running scripts in Roblox—but bundles a multi-function Java RAT and infostealer.

This is not a vulnerability in Roblox itself. The attack depends on someone downloading software from an untrusted source, often after a recommendation on a forum, Discord or a compromised account. Businesses should care because one computer may be used for gaming, email, banking and remote work, while stolen browser sessions cross the boundary between personal and corporate activity.

Inside the fake package

Bitdefender Labs has tracked the campaign since early 2026, with a significant rise in March. A ZIP archive or self-extracting installer imitates the legitimate tool’s directory structure, includes Lua files and launches xeno.exe as the first-stage loader.

The loader checks for a Java Runtime Environment and attempts to install it if absent. It then reads validation keys and starts an obfuscated Java file named decompiler.exe. The next stage profiles the environment, registers the victim with operator infrastructure and retrieves the full RAT.

Java is useful to the attacker because part of the logic runs outside the Windows scripting tools most defenders expect, while large obfuscated JARs can receive less scrutiny from simple rules.

Access extends far beyond a game account

The analysed RAT searches Chrome, Edge, Brave, Opera and Vivaldi. It steals tokens and data associated with Discord, Roblox, Minecraft and Microsoft accounts, alongside payment information and cryptocurrency wallets including Exodus.

An operator can also:

• log keyboard and mouse input;
• capture screenshots and stream the desktop;
• access the webcam;
• upload and download files;
• run PowerShell and an interactive shell;
• collect history, cookies and stored credentials.

Bitdefender links the samples to a broader campaign ThreatLocker calls “Powercat”. Operators continue updating components and C2 locations, so a single hash is not a durable detection strategy.

Who needs to respond

Gamers installing mods, cheats and executors are the clearest target group. Inside an organisation, however, any unapproved “helper” tool is relevant: a generator, converter, crack, Discord client or AI add-on. This campaign demonstrates how personal motivation can lead to theft of a corporate Microsoft 365 token held in the same browser.

Parents and schools should explain the economics of the scam rather than only banning a game. “Premium for free”, bypassing controls and instructions to disable antivirus are part of the lure. A Discord post or forum thread does not verify a file’s provenance.

After suspicious Xeno execution

Disconnect the device and do not use it to sign in anywhere else. From a clean system, change passwords, revoke active sessions, refresh tokens, enable MFA or passkeys, and review email rules and registered OAuth applications. Cryptocurrency wallets require a separate secret-migration process.

An enterprise incident must cover endpoint, identity and cloud evidence. Uninstalling the program does not reverse cookie theft. Hunt for unusual Java processes started from downloads or temporary directories, JRE installation immediately before the event, new JAR network connections, PowerShell spawned by Java and anomalous sign-ins.

See our guides to infostealers and session theft and recognising phishing and fake tools for the wider context.

Primary facts versus Breachroad analysis

Bitdefender confirms the analysed chain, RAT capabilities and observed distribution. BleepingComputer provides an independent account. There is no basis to identify the official Roblox platform or legitimate Xeno project as the malware’s author; criminals are abusing their recognition.

Breachroad’s conclusion is that personal behaviour on devices with corporate access belongs in the threat model without blaming the user. Cybersecurity and phishing training teaches safe file verification and rapid reporting, while an IT security audit can assess profile separation, EDR and session-revocation procedures.