Harish Kumar 
A malware campaign masquerading as an “undetected” build of Xeno, one of the most widely used Roblox script executors, has been quietly infecting gamers since early this year, and researchers say it has grown far more dangerous than a typical password stealer.
Bitdefender Labs disclosed on August 3 that the fake tool is being pushed through gaming forums and Discord servers, often by compromised or impersonated accounts posing as trusted community members. Victims believe they’re getting a script executor that bypasses Roblox’s anti-cheat system.
Instead, they trigger a multi-stage Java infection chain that ends in a stealer capable of webcam surveillance, live desktop streaming, keylogging, and full interactive remote control of the machine.
Fake Xeno Roblox Cheat Delivers Powerful Java Stealer
The trap begins with a ZIP archive or self-extracting package built to mimic a real Xeno installation, complete with genuine Lua scripts pulled from the legitimate tool to add authenticity. The victim is instructed to run what appears to be the main executable, located at a path resembling a normal Xeno cache folder. That file is actually the first stage of the malware.
Stage one silently checks for a Java runtime and installs one if missing, then reads encryption keys hidden inside an innocuous-looking image file before launching a second-stage JAR disguised as a Windows executable.
That JAR, obfuscated with a commercial tool called Allatori, profiles the machine for signs of sandboxes or debuggers, checking disk size, virtual-machine artifacts, and known analysis processes before phoning home to a command-and-control server to fetch a validation key and the final payload.
The last stage ends up in a folder associated with Xbox Game Bar (formerly Microsoft GameDVR) and masquerades as a legitimate Windows DLL. It sets up persistence through a registry Run key labeled innocuously as “Display Calibration” and even attempts to escalate privileges via CMSTP before opening a WebSocket connection to its C2 infrastructure.
Once established, the implant goes well beyond credential harvesting. It targets browser cookies and saved logins across Chrome, Edge, Brave, Opera, and Vivaldi; hijacks Discord, Roblox, and Minecraft accounts (including data from launchers such as Lunar, Feather, and Prism); and retrieves stored payment tokens from Microsoft Store login caches.
Its cryptocurrency-targeting logic is notably aggressive: for Exodus wallets, the malware actually injects JavaScript into the wallet application’s own files to log runtime data to a hidden file, rather than just hunting for static wallet files on disk.
It also scans for wallets such as Atomic, Cake Wallet, SafePal, and Monero Wallet, as well as VPN clients and development tools that might indicate a more valuable target.
Beyond theft, operators can remotely activate keylogging, mouse tracking, screenshot capture, a live desktop feed refreshed every 500 milliseconds, and webcam access through DirectShow components alongside file upload/download, PowerShell execution, and a full interactive shell.
The campaign isn’t new; ThreatLocker researchers previously documented it as Powercat. But Bitdefender’s telemetry shows new C2 domains and expanded capabilities, indicating the operators are actively maintaining and upgrading the toolkit rather than running a static, aging kit.
Infections have been recorded since the start of 2026, with a sharp spike in mid-to-late March that has since leveled into steady, ongoing activity.
Roblox’s massive player base skews young, and cheat tools promising an “undetected” edge are a persistent lure on Discord and modding forums. Because many of these accounts run on shared family computers, a single infection can expose saved passwords, private chat logs, webcam footage, and stored payment details belonging to an entire household.
Legitimate copies of Xeno are only distributed through its official sites, and any version advertised as bypassing detection on third-party forums should be treated as a red flag.
Security researchers recommend avoiding unofficial executors entirely, keeping endpoint protection up to date, enabling multi-factor authentication on gaming and payment accounts, and talking to younger users about the risks of downloading cheats.
About the Author
Kiran 
