Trojanized tools for the Roblox and Xeno games have been harnessed to deliver a remote access trojan on Windows systems, HackRead reports.
Attackers leveraged browsers and chat platforms to deceive targets into downloading the seemingly legitimate RobloxPlayerBeta.exe and Xeno.exe files, which inject a portable Java runtime and deploy the illicit jd-gui.jar archive, said Microsoft Threat Intelligence researchers in a post on X. Subsequent exploitation of PowerShell and living-off-the-land binaries then allows the execution of a PowerShell script that retrieves and executes malware, which not only conceals its original downloader but also adds malicious file exclusions in Microsoft Defender, while ensuring persistence, according to analysts.
With the final malware's multi-layered functionality providing extensive control over impacted systems, organizations have been urged to bolster outbound traffic tracking. Organizations should also block connections to IP addresses and domains included in the indicators of compromise, as well as inspect for dubious Microsoft Defender exclusions and scheduled tasks.
