Loading story…
Attackers are distributing fake installers for the Xeno Roblox script executor through Discord communities, gaming forums, and compromised or impersonated accounts, luring players with claims of an "undetected" cheat tool. When victims run xeno.exe, the installer checks for Java, drops or installs a local Java runtime, retrieves validation data, and launches an obfuscated JAR masquerading as decompiler.exe, leading to a multi-stage infection chain tied to the previously documented Powercat malware family.
The final payload combines an infostealer with a remote access trojan, stealing browser cookies and saved data, Discord and Roblox tokens, Minecraft data, payment details, and cryptocurrency wallet information. It also supports keylogging, screenshots, webcam capture, desktop streaming, file transfer and manipulation, PowerShell execution, and interactive remote shell access, while using anti-analysis checks, persistence via the Windows Run registry key under "Display Calibration", and WebSocket-based command-and-control with self-update capability; researchers said the campaign has been active since the start of the year and poses particular risk to children and teenagers seeking Roblox cheats.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Bitdefender observed the campaign rising sharply in the second half of March before later stabilizing. The surge marked an escalation in the volume of activity targeting Roblox users.
Attackers began targeting users seeking Roblox cheats with fake Xeno Executor installers distributed through gaming forums and Discord communities. Bitdefender said the activity has affected users since the beginning of the year.
A threat research notice disclosed indicators of compromise for the fake Xeno/Powercat campaign, including domains, URLs, and multiple MD5 hashes. The notice also detailed the malware's Java-based stealer and RAT capabilities, including theft of browser, gaming, and crypto data plus remote-control features such as keylogging, webcam access, and PowerShell execution.
Bitdefender reported that newly observed infrastructure and expanded capabilities indicate the malware remains active and under development. The company assessed the fake Xeno activity as likely related to the previously documented Powercat campaign, but with upgraded capabilities and new command-and-control infrastructure.
Bitdefender said the fake Xeno malware activity is related to a campaign previously documented by ThreatLocker under the name Powercat. This establishes the earlier known malware family to which the current activity is linked.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetrojan-killer.net
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcebleepingcomputer.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence reported an active malware campaign targeting gamers by distributing **trojanized gaming utilities** through browsers and chat platforms, leading victims to execute a multi-stage downloader that ultimately installs a **Java-based remote access trojan (RAT)**. The infection chain was observed staging a portable Java runtime and launching a malicious JAR (`jd-gui.jar`), while using **PowerShell** and living-off-the-land binaries such as `cmstp.exe` to reduce detection. The activity includes defense evasion by deleting the initial downloader and adding **Microsoft Defender exclusions**, and persistence via a scheduled task and a startup script named `world.vbs`; the RAT then beacons to **`79.110.49[.]15`** for C2, enabling data theft and follow-on payload delivery. Reporting also noted the campaign’s use of gaming-adjacent filenames to increase execution likelihood (e.g., `Xeno.exe`, `RobloxPlayerBeta.exe`) and emphasized that the final payload functions as a **loader/runner/downloader/RAT** rather than a single-purpose stealer, increasing the risk of secondary malware deployment. Separately, one report highlighted the emergence of *Steaelite*, a Windows RAT advertised on criminal forums with claimed “FUD” capabilities and an integrated panel combining data theft and ransomware features, underscoring broader commoditization of multi-function RAT ecosystems even when not directly tied to the specific trojanized-gaming-tools intrusion chain.
Jun 29, 2026
Researchers detailed two separate malware operations that rely on stealth and in-memory execution to steal credentials and maintain remote access. One campaign targeted Roblox exploit users with a trojanized executor branded as **Yuta/Solara**, presenting a polished .NET WPF interface with AI-themed features while silently deploying a PyInstaller-packed Python 3.12 stealer linked to the Glove Stealer family. The malware harvested browser credentials, Roblox cookies, developer secrets, MetaMask vaults, Discord tokens, and Google account artifacts, while using AMSI and ETW patching, Windows Defender tampering, AppLocker evasion, persistence mechanisms, and Discord webhooks for exfiltration.
Jun 29, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026