Fake Roblox Xeno executor installers distribute malware

Fake Xeno Executor installers are targeting Roblox players with malware that provides remote access and steals sensitive information. This campaign has been active since the start of the year, with a notable increase in activity in March, based on information published by Bleeping Computer.

Cybersecurity firm Bitdefender has identified a campaign distributing malware disguised as the popular Roblox utility, Xeno Executor. Threat actors promote these fake installers on gaming forums and Discord, luring users seeking undetected versions of the tool. Once executed, the malware, a Java-based RAT and information stealer, steals browser data, online account credentials (including Discord and Roblox), cryptocurrency wallet information, and enables surveillance capabilities like keylogging and webcam access. It also provides attackers with full remote control over the victim's system. Bitdefender believes this campaign is an evolution of previously documented malware, indicating continuous development by attackers. They advise Roblox players to avoid installing third-party tools from untrusted sources.

Source: Bleeping Computer