A deceptive cyberattack is targeting Roblox users with a fake "undetected" version of an Xeno script executor This article explores environments malware leverages. . Spread through gaming forums and Discord communities, this installer appears to offer cheat features but instead delivers a Java-based information stealer and remote access trojan.
Researchers discovered that the malware captures screenshots every 500 milliseconds, sending them to attacker-controlled servers, effectively creating a near-live desktop feed. It also records keystrokes, monitors mouse activity, accesses webcams, steals accounts, and runs remote commands. Some files are genuine Lua scripts, while others appear harmless but serve as decoys to make the archive look authentic. Fake Roblox Cheats Stream Desktops Victims are directed to run xeno.exe from a folder under %LOCALAPPDATA%\Xeno\workspace\cache.
Malware checks system disk size, network adapter details, registry entries, running processes, and other artifacts typically found in analysis environments. Malware leverages persistence through the Windows Run registry key named "Display Calibration" to ensure continuous execution upon login. Researchers noted an update function that enables operators to replace the existing payload with a newer version, suggesting ongoing development of the operation previously tracked as Powercat.
Bitdefender reported this threat. Indicators of Compromise Type Value Description MD5 4bdaf7792e908f163ebef137854c571d Archive containing fake Xeno installation MD5 9930036e8f787674db39094e21413e77 Archive containing fake Xeno installation Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking.
