A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players looking to download a legitimate tool.

Promoted through various gaming forums and Discord communities, the fake cheat launches a multi-stage Java infection chain built to stay hidden in plain sight. Its components imitate real Xeno files, use Windows-style names and hide inside trusted-looking directories, which includes a folder associated with Xbox Game Bar, formerly Microsoft GameDVR.

The final payload goes far beyond conventional credential theft. It can steal browser cookies, Discord, Roblox and Minecraft accounts, cryptocurrency-wallet data and payment information.

Unlike the more generic stealers, this one can also record keystrokes, access the webcam, stream the victim’s desktop, manipulate files, run PowerShell commands and give attackers interactive control of the infected computer.

Newly identified command-and-control infrastructure and expanded functionality suggest the malware, previously documented as Powercat, remains under active development.

The campaign is particularly worrying because Roblox-related cheats can attract children and teenagers, potentially exposing accounts, private conversations, webcam images and financial information stored on shared family computers.

Key findings

• Attackers distribute the malware as an undetected version of the Xeno Roblox script executor through gaming forums and Discord communities.
• The campaign uses a multi-stage Java infection chain with files, directories and persistence mechanisms that imitate legitimate Windows and gaming components.
• The final payload combines information theft, surveillance, persistence, remote access, file manipulation and command execution.
• Its targets include Discord, Roblox and Minecraft accounts, browser data, cryptocurrency wallets and payment-related tokens.
• Researchers identified new command-and-control infrastructure and additional capabilities, suggesting continued development.
• Security insights show that users have been affected since the beginning of the year, with activity rising sharply in the second half of March.

Introduction

Gaming communities offer threat actors a fruitful environment for reaching potential victims. Players frequently exchange mods, scripts, and unofficial tools through forums, Discord servers and file-sharing websites.

Attackers are all too aware of gamers’ habits. They can exploit this behavior by disguising malware as cheats or utilities that promise exclusive features, improved performance, or the ability to evade anti-cheat systems.

Bitdefender security researchers have identified a malware campaign targeting players searching for cheats for games such as Roblox. The campaign impersonates Xeno, a popular Roblox script executor used to automate actions and run custom scripts.

Because such tools are frequently detected or blocked by the game client, versions advertised as “undetected” can be particularly attractive to users seeking to bypass these restrictions.

The malicious packages are promoted through forums and Discord communities, either directly by the operators or through compromised and impersonated accounts.

Throughout the infection chain, the malware tries to maintain a veneer of legitimacy. Its components imitate files from a Xeno installation, while later stages use Windows-like DLL names, trusted-looking directories and display-related persistence entries.

The final malware stage is a sophisticated stealer and remote access trojan that uses anti-analysis and anti-sandboxing techniques, which means that it’s trying hard not to be analyzed by security researchers.

It can steal browser cookies, personal accounts such as Discord, Roblox and Minecraft, and payment-related information that could lead to financial damage.

ThreatLocker researchers previously documented this campaign under the name Powercat. Our insights revealed additional command-and-control domains and capabilities, which suggests that the malware remains under active development and continues to be used in cybercriminal operations.

The campaign has affected users since the beginning of the year. Activity increased significantly during the second half of March and has since maintained a relatively consistent infection rate.

Initial Access: Fake Xeno Cheats and Stage 1 Execution

For initial access, users are tricked into downloading fake game cheats, such as Xeno, a widely used cheat software for Roblox. The software packages often come either in the form of archives containing extraction and execution instructions or as self-extracting archives that automatically unpack and prepare the environment.

These archives use a directory structure that resembles a legitimate Xeno installation. File names are chosen to make the package look convincing to users expecting Roblox cheat software. Some files are indeed LUA scripts taken from a Xeno installation, while others, such as RbxAnalytics.png, are only small 10-byte files containing junk data.

The user is then told to run the main entry point located at %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe, believing it will launch the expected game cheat. In reality, this is not the legitimate Xeno binary, but the first stage of the malware masquerading as it.

First, xeno.exe checks whether a Java executable exists at %LOCALAPPDATA%\Java\jre\bin\javaw.exe. If the file is missing, it extracts a Java Runtime Environment to that path from an archive named instance.exe, using an embedded PowerShell command.

powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command \"Add-Type -AssemblyName System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory(...)

Next, xeno.exe reads the contents of XenoIcon.jpg, which contains the keys required by the second stage to validate its execution with the C2 server. Finally, it launches javaw.exe to execute a JAR file masquerading as decompiler.exe, passing the contents of XenoIcon.jpg as command-line arguments.

Stage 2: decompiler.exe, a JAR Disguised as a Windows Executable

The decompiler.exe file is a JAR file masquerading as a Windows executable. Its Java bytecode is obfuscated with the demo version of Allatori, a legitimate commercial obfuscation tool that the malware authors have abused. This can be at least partially deobfuscated, although the flow obfuscation is not fully reversible.

The class and variable names are also characteristic of Allatori, making the decompiled code harder to read. The main function begins by printing a banner to the console.

If the two required arguments are passed to the application, it starts collecting information about the environment in which it is running.

The malware looks for traces of debugging, artifacts that indicate sandbox execution, and information needed to validate the JAR execution.

After gathering these details, it sends a POST request to the C2 server containing the collected flag values.

These values are used to register the victim machine and determine whether it should receive additional payloads.

For debug detection, the code checks runtime arguments such as -xdebug, suspend=, and jdwp, as well as modules appearing in stack traces, including intellij, eclipse.jdt, netbeans, and bytecodeviewer. If any of these strings are present, the code returns zero, causing the final flag value to fall below the threshold expected by the server.

Sandbox detection is performed through several checks. The malware verifies whether the disk partition size exceeds 20 GB, looks for well-known MAC addresses associated with emulated network adapters, checks the registry and WMI for virtual machine artifacts, and iterates over running processes to detect monitoring tools commonly used in automated analysis environments.

The function responsible for communicating with the C2 server receives a message as a parameter, creates a JSON object from it, opens a connection to hxxps://solthere[.]net/justacoolkat10, and sends the JSON object through a POST request.

After this initial logging, the code calls another function that connects to the C2 server through a different endpoint and sends the key received through the command-line arguments for validation.

The URL used for payload retrieval is hxxps://solthere[.]net/api/v1/redeem. The key is encrypted with AES, and the resulting buffer is Base64-encoded before being sent in the POST request body.

The retrieved payload is then loaded using the loadClass method. Its entry point is identified by iterating through all methods of the received object.

Once the entry point is found, it is invoked through method.invoke(). This payload then downloads and writes the third stage to %LOCALAPPDATA%\Microsoft\GameDVR.

To execute it, the malware launches a new javaw.exe process and passes the path of the JAR file as an argument.

Stage 3: A Java Stealer Masquerading as a Windows DLL

The third stage is a Java-based stealer and surveillance malware that can collect personal information from browsers, Discord, and games. It can also collect screenshots and webcam footage, stream the victim’s desktop, and monitor keyboard and mouse activity.

In addition, it can download and upload files, execute commands through PowerShell, and open an interactive shell for hands-on-keyboard access, allowing full system takeover.

The JAR file masquerades as a seemingly legitimate DLL located in %LOCALAPPDATA%\Microsoft\GameDVR. The possible DLL names mimic legitimate Windows DLLs that normally reside in the Windows directory.

Upon execution, the malware checks the environment in a similar fashion to the second stage. However, instead of sending the collected information to the C2 server, it terminates if a sandbox is detected.

The malware also creates a local log file named -ntcache in the current user’s home directory, where it records execution progress with timestamps.

After that, the malware attempts to move execution to a CMSTP process with elevated privileges. If privilege escalation succeeds, the low-privilege javaw.exe process terminates. If privilege escalation fails, execution continues.

The subsequent malware flow appears to be the same in both elevated and non-elevated contexts.

The malware then contacts two online services that can identify IP addresses (ipapi[.]co and ipwho[.]is) to obtain geolocation information about the victim. This information is later used during the C2 connection process to generate a unique identifier based on the system’s hardware profile.

Persistence is established by adding the command line that runs the JAR file to the Software\Microsoft\Windows\CurrentVersion\Run registry key under the name Display Calibration.

The malware then enables the Run entry by setting Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run for Display Calibration to the value 2.

Once persistence is enabled, it starts two threads responsible for collecting and sending crypto wallet data stolen from Exodus wallets. It then calls the function that creates a WebSocket connection to the C2 server.

The server URI is generated at runtime by calculating the SHA-256 hash of the string print, removing the last character, and appending .xyz.

Thus, the resulting C2 address is ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a[.]xyz. The management server then assigns a subdomain to the client and responds with the string needed to build the full URI. The client can only connect to the C2 through that URI for the active session.

Once the connection is established, the server can send two types of data over the socket. The first type is an updated JAR file. The received bytes are written to %LOCALAPPDATA%\Microsoft\GameDVR using one of the DLL-like names from the malware’s list of possible masquerading filenames.

The new version is then executed using the exec method, while the old version terminates by calling halt.

The second response type is an encrypted string. Once decrypted, it contains a JSON object with a task identifier and its parameters. The task identifier acts as an index in an array of possible actions.

By analyzing all functions in this array, we uncovered the malware’s capabilities.

These commands can be grouped into several broader categories: connection management, surveillance, file system operations, personal information theft, shell access, and command execution.

Connection management actions include performing a handshake with a secret string and validating that the client is communicating over the expected socket. The server can also instruct the client to open a new connection on a new socket.

File system commands include standard directory listing, upload, download, and rename operations. Command execution is performed by launching a PowerShell process that executes a Base64-encoded command received as a parameter.

The interactive shell is implemented in a similar way, using a PowerShell process whose input and output are redirected to the Java process, which then forwards the buffers to the C2 server.

Surveillance Capabilities

The surveillance command set includes keylogging, mouse movement logging, screenshot capture, display streaming, and webcam capture.

Webcam capture is performed by interacting with COM objects related to DirectShow. The captured buffers are then streamed to the C2 server.

Display monitoring can be performed in two ways: the malware can either capture individual screenshots using the screenshotCapture command or enable a streaming mode that captures a screenshot every 500 milliseconds and continuously sends the images to the C2 server, effectively creating a live feed.

The server can also request a list of connected displays in order to choose which one to capture.

Mouse and keyboard logging are implemented through Winuser from the Java Native Access API. This allows the malware to interface with Windows functions from User32 and register hooks for mouse and keyboard events.

Personal Information Theft

Personal information theft begins with the malware gathering information about potentially interesting software installed on the victim’s system. This allows the operators to adapt their strategy and prioritize which data to steal.

The function we named mapInterestingSoftware checks standard installation paths for various applications and stores the results in a HashMap. Once the checks are complete, the contents of the HashMap are sent to the C2 server.

The checked software includes crypto wallets such as:

• Exodus, Atomic, Cake Wallet, SafePal, TronWallet, and Monero Wallet
• Software development tools such as Visual Studio, Git, JetBrains tools, and Python IDLE
• Game launchers such as Steam, Rockstar Games Launcher, Battle.net, Epic Games Launcher, and Riot Client
• Roblox and Minecraft installations
• VPN software such as NordVPN, Mullvad VPN, ExpressVPN, and Surfshark
• Messaging software such as Telegram, Snapchat, WhatsApp, and Discord

After this initial discovery phase, the stealer uses dedicated functions for some of its main targets.

The stealer implements one wallet-specific attack against Exodus cryptocurrency wallets.

This logic is handled by the two threads instantiated by the main function. The first thread checks whether Exodus version 26.1.5 is installed on the system. If the wallet is present, the malware extracts the app.asar file, injects two small JavaScript snippets into the application’s files and repacks them.

One of the scripts modifies the wallet’s sandboxing and context isolation configuration, while the other logs wallet-related buffers to a file named SquirrelInteractive.bin in the user’s home directory.

This approach suggests that the malware is not simply searching for static wallet files, but rather actively tampering with the local Exodus application to expose sensitive runtime data. The second thread periodically checks for the presence of SquirrelInteractive.bin.

If the file exists, it parses the logged contents, extracts valid tokens, and sends them to the C2 server.

For browser collection, the malware defines custom classes for each supported browser, including specific paths where potentially valuable information is stored, such as cookies and user data.

The browsers recognized by the malware are Brave Browser, Chrome, Edge, Opera, Opera GX, and Vivaldi.

Discord token theft is performed in two steps. First, the malware checks browser cookies for saved tokens associated with discord[.]com and extracts information stored in browser SQLite databases.

It then uses the Discord API to retrieve information about the logged-in account, including stored payment methods.

Roblox and Minecraft cookies are also processed to retrieve account and login information. For Minecraft, the malware can identify multiple launchers and extract sensitive information stored by each of them.

The known launchers are Feather, Lunar, Meteor, Modrinth, Prism, and the official Minecraft launcher.

Finally, the malware can extract tokens from Microsoft Store logins with the goal of stealing stored payment information. It locates .tbres files in the Token Broker or Cache directories and searches their contents for patterns that indicate the beginning of a token.

Any valid token found is sent to the C2 server.

Impact on Victims

The malware can severely impact victims’ privacy because it gives attackers access to both stored personal information and real-time activity.

In addition to stealing browser cookies, account credentials, cryptocurrency-wallet data, and payment-related tokens, it can record keystrokes and mouse activity, capture screenshots, stream the desktop, access the webcam, and remotely browse or modify files.

This combination enables attackers to observe private conversations, collect sensitive images and documents, impersonate victims, take over online accounts, and possibly inflict financial loss.

Its remote-access and command-execution capabilities also mean that the compromise can continue beyond the initial theft of information, which can lead to data destruction or allow operators to use the infected system in other cyber-criminal activities.

Conclusions

Gaming-related lures remain effective because they exploit users’ interest in gaining an advantage, accessing restricted functionality, or avoiding anti-cheat detection.

In this campaign, attackers used a convincing imitation of the Xeno Roblox script executor and promoted it through channels commonly used by gaming communities. Familiar filenames, copied scripts, legitimate-looking directories, and Windows-related persistence names helped the infection chain appear credible while concealing its malicious purpose.

The delivered malware is considerably more capable than a typical credential stealer. Its final stage combines browser and account theft with cryptocurrency-wallet targeting, payment-token collection, keylogging, screenshots, webcam access, desktop streaming, file operations, PowerShell command execution, and interactive shell access.

Persistence and self-update functionality allow the operators to maintain control over infected systems and deploy new versions, while newly observed infrastructure and capabilities indicate that the campaign remains active and continues to evolve.

Users can reduce their exposure by combining effective security controls with cautious online behavior.

Updated endpoint protection, reputation-based blocking, application-control policies, multi-factor authentication, and restrictions on software execution can prevent or limit many stages of the attack.

However, the most effective first line of defense remains avoiding unofficial cheats and executors, particularly those distributed through untrusted websites, archives, forums, or unsolicited Discord messages.

Recognizing these lures before execution can prevent account theft, financial loss, and complete system compromise. Discussing common gaming-related scams with younger users can also significantly reduce the risk of infection.

IoCs

This article is published for informational and educational purposes only. The information presented is based on technical research conducted by Bitdefender Labs and publicly available sources. Bitdefender does not make any legal determination regarding the activities described herein. The mention of any company, brand, domain, or individual does not constitute an accusation of illegal activity. Readers should exercise their own judgment and consult appropriate authorities or legal counsel if they believe they have been affected by any of the activities described. Domain names and URLs listed in this article are provided solely to help consumers and security professionals identify potentially harmful infrastructure. Bitdefender disclaims any liability for actions taken based on the information in this article.