Fake Roblox Xeno Script Launcher Delivers Multi-Stage Java RAT and Infostealer

An ongoing malware campaign is targeting gamers by pushing a fake Roblox Xeno script launcher bundled with a dangerous multi-stage Java RAT and information stealer. By posing as an “undetected” release of Xeno Executor—a widely used utility designed to execute custom Lua scripts and cheats within Roblox—threat actors are capitalizing on users attempting to bypass the game platform’s anti-cheat protections. Discovered by Bitdefender, the campaign has been active since the beginning of the year, experiencing a sharp surge in activity in March before stabilizing into a steady infection stream across gaming communities.

Because utilities like Xeno Executor operate outside official channels, the Roblox client frequently updates its anti-cheat controls to block existing versions. This forces players to hunt down updated executables, creating an ideal lure for social engineering attacks. Gamers looking to maintain their in-game advantages actively search out bypasses, making them far more likely to download unsigned software, ignore local security warnings, and execute untrusted binaries.

Trojanized Packaging and Social Engineering

The threat actors distribute the fake Xeno installer through gaming forums, Discord servers, and compromised or impersonated user accounts. To trick victims into executing the payload, the attackers construct highly authentic delivery packages using ZIP archives or self-extracting files.

To maximize convincingness, the malicious packages carefully mimic the legitimate layout of the official tool:

• The archive recreates the exact directory structure of a real Xeno Executor installation.
• The package includes genuine Lua scripts to give the impression of a functional tool upon inspection.
• All components rely on plausible filenames to avoid raising suspicion during manual unzipping.

The vulnerability exploited here is not a software flaw in Roblox itself, but rather human behavior—specifically Trojanization. By leveraging the user’s explicit intent to run an unapproved third-party utility, the attackers trick the victim into initiating the execution chain with elevated user privileges.

The Multi-Stage Java Delivery Chain

When a victim opens the package and runs xeno.exe, believing it to be the legitimate launcher executable, they trigger a multi-stage execution chain designed to establish persistent access and download the final malware payload.

1. First-Stage Loader Execution: Upon execution, xeno.exe acts as an initial loader. It checks the host system for a local Java Runtime Environment (JRE). If a JRE is absent, the loader extracts a bundled runtime environment directly onto the host—a classic “bring-your-own-environment” technique that ensures the Java payload can run regardless of host configuration.
2. C2 Validation Key Extraction: The loader reads a local configuration file packed within the archive to obtain cryptographic validation keys necessary to authenticate with the threat actor’s command-and-control (C2) server.
3. Payload Stager Execution: The loader executes an obfuscated Java payload disguised under the process name decompiler.exe.
4. Environment Verification and Registration: decompiler.exe conducts sandbox and environment checks, registers the newly compromised host with the C2 infrastructure, and fetches the final stage.

Capabilities: Surveillance, Token Theft, and Remote Control

The final payload delivered by decompiler.exe is a feature-rich, Java-based Remote Access Trojan (RAT) and info stealer. Once established, it provides the attackers with complete control over the compromised machine while systematically harvesting sensitive credentials and financial data.

Credential and Session Theft

• Web Browsers: Extracts stored credentials, cookies, and autofill data from Chrome, Microsoft Edge, Brave, Opera, and Vivaldi.
• Platform Tokens: Targets authentication tokens for Discord, Roblox, Minecraft, and the Microsoft Store, allowing attackers to hijack sessions without needing multi-factor authentication codes.
• Financial Data: Steals payment information associated with linked Discord and Microsoft Store user accounts.
• Cryptocurrency Wallets: Features specialized extraction logic for Exodus Wallet data alongside broad scanning routines designed to identify dozens of other popular cryptocurrency wallet formats.

Surveillance and Remote Administration

• Full Surveillance Suite: Logs keystrokes, tracks mouse movements, captures desktop screenshots, streams the live desktop, and silently hijacks webcam feeds.
• Remote Control Capabilities: Provides an interactive remote shell, enabling attackers to execute arbitrary PowerShell commands and freely upload or download files to and from the victim machine.

Evolution from the “Powercat” Campaign

Bitdefender’s analysis links this operational campaign directly to activity previously documented by ThreatLocker under the name “Powercat.” However, this recent wave represents a significant evolution in the threat actor’s toolset. The group has completely refreshed its C2 infrastructure to evade existing IP and domain blocklists and introduced significant enhancements to both the obfuscation layers and surveillance capabilities of the underlying Java RAT.

Enterprise Blast Radius and Defense

While this campaign primarily targets consumers and gaming enthusiasts, its enterprise blast radius is non-trivial. In environments where employees utilize personal devices for remote work (BYOD) or log into personal accounts (such as Discord, Chrome, or Microsoft) on corporate laptops, an infection of this nature immediately exposes enterprise assets. Stolen browser cookies and saved credentials can easily grant attackers access to corporate single sign-on (SSO) portals, cloud storage, and internal platforms.

To mitigate risk against this and similar Trojanized utility campaigns:

• Enforce Execution Policies: Implement strict Application Control or AppLocker policies blocking unsigned executables running from user-writable directories such as %TEMP%, %APPDATA%, and compressed archive paths.
• Monitor Java Process Activity: Set up EDR detection rules targeting unusual JRE deployments, particularly instances where decompiler.exe or temporary Java binaries spawn PowerShell commands or initiate outbound network connections.
• Session Invalidation: If an infection is identified on a network host, immediately revoke and reset all browser-saved credentials, session cookies, and OAuth tokens associated with Microsoft, Discord, and primary email accounts accessed from that machine.
• Restrict Personal Software: Enforce strict acceptable-use policies preventing the installation of unauthorized gaming utilities, script executors, or cracked software on corporate-managed endpoints.