GoKawiilFake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information.
Xeno Executor is a popular Roblox utility for running scripts that players can use to automate actions or run custom code on the platform, including cheats.
The tool isn’t an official part of the game, so the Roblox client periodically blocks existing versions, forcing the tool’s creators to release new versions that run undetected.
Cybersecurity company Bitdefender discovered a campaign targeting Roblox users since the start of the year, rising sharply in March before stabilizing.
The researchers found that the fake Xeno is promoted to Roblox players through gaming forums, Discord communities, or via compromised or impersonated accounts controlled by the threat actors.
The attackers advertise the malware as an "undetected" version of Xeno, luring users looking for a version that wouldn't be detected by Roblox's anti-cheat protections.
The victims download ZIP archives containing the fake Xeno installers along with instructions, or self-extracting archives that unpack content automatically.
To make these packages look authentic, the attackers recreate the directory structure of a legitimate Xeno installation, include some genuine Lua scripts, and use plausible filenames.
Once victims launch ‘xeno.exe,’ as instructed, believing it is the legitimate Xeno executable, they actually run the first-stage malware loader.
The payload checks for a Java Runtime Environment, and extracts one if necessary, then reads a local file containing the validation keys for the attackers' command-and-control (C2) server.
... continue reading