Compensation is received for the products and services mentioned in this story; however, the opinions expressed are solely those of the author. The placement of offers may be influenced by this compensation, and not all available products or offers are included. For further details, please explore how we generate revenue and our editorial policies.
In recent developments, Roblox finds itself grappling with a new threat that raises significant privacy concerns. This time, the platform is facing scrutiny for potentially allowing the infiltration of privacy-invasive spyware, disguised as an “undetected” version of the Xeno Roblox cheat tool. Once users install this dubious software, it can gain access to their screens, record keystrokes, and even activate webcams, enabling attackers to execute remote commands on the compromised systems.
How the Roblox spyware infects your system
According to a security report by Bitdefender, the attack commences when a victim downloads an archive file that closely resembles a legitimate Xeno installation. These files are being circulated on platforms like Discord and various gaming forums, marketed as an “undetected” cheat tool. The folder structure and remnants of authentic files lend an air of credibility to the malicious software.
This malware, previously identified by ThreatLocker as Powercat, has now evolved, as indicated by new findings from Bitdefender that reveal an updated command-and-control (C2) infrastructure.
The attack unfolds in several stages:
Stage 1
The initial step involves the victim executing the main file, Xeno.exe, which is not the genuine cheat program but rather the first phase of the malware. Upon execution, it checks for the presence of Java on the system, as subsequent stages require the Java Runtime Environment (JRE). If Java is absent, the malware extracts it from a file named instance.exe using a concealed PowerShell command, subsequently retrieving hidden keys stored in a file called XenoIcon.jpg.
Stage 2
In the second stage, the malware initiates javaw.exe to run a JAR file disguised as decompiler.exe, camouflaging itself as a standard Windows application. The internal code of this program is obfuscated using Allatori, a popular Java obfuscation tool. The program performs preliminary checks to ensure it is not being analyzed by security researchers or running in a sandbox environment. The results of these checks are relayed to the attacker’s C2 server, where the malware validates its legitimacy using the secret key extracted earlier.
Stage 3
The final stage sees the spyware masquerading as a legitimate Windows system DLL file. It conducts similar checks for debugging and sandbox environments. If it detects either, it shuts down immediately. If successful, however, the malware logs its activities and attempts to escalate its privileges using the legitimate Windows tool CMSTP. If this fails, it continues operating with standard user privileges.
- It logs its progress for the attacker’s reference.
- It seeks to elevate its privileges on the user’s system.
- It uses the user’s IP address to approximate their location and create a unique system ID.
- It adds itself to the list of auto-start programs, ensuring it launches with each system boot.
- It establishes a live connection to the attacker’s C2 server for real-time command execution.
- It can receive updates from the C2 server, showcasing its evolving nature.
What the malware can do
If the attack is successful, the perpetrator gains extensive control over the victim’s system. This includes access to the webcam, screen recording, keystroke logging, and the ability to steal sensitive information such as cryptocurrency wallet credentials and payment details. The malware’s keystroke logging capabilities mean it can capture virtually any information typed, including personal identifiers like email addresses and passwords, which could lead to identity theft or financial fraud.
Bitdefender’s report also highlights a particularly alarming tactic: the malware can modify files associated with cryptocurrency wallets, disabling their security features and logging wallet activities for exfiltration.
What can you do to protect yourself
To safeguard against this invasive spyware, consider the following measures:
- Avoid unofficial cheats: The allure of “undetected” cheat tools can be tempting, but they often serve as bait. Steer clear of such offerings.
- Use a third-party antivirus program: A reliable antivirus solution is crucial for detecting and removing malware. Conduct regular scans, especially after installing any cheat tools.
- Do not click on unsolicited links: Exercise caution with links shared on gaming forums or Discord, particularly those from unfamiliar accounts.
- Enable two-factor authentication (2FA): This adds an extra layer of security to your accounts, making unauthorized access significantly more difficult.
- Inspect any UAC prompts: Be wary of User Account Control prompts when installing unknown files, as they may indicate attempts to gain elevated privileges.
- Use an identity theft protection service: If you’ve interacted with suspicious tools, consider a professional service to monitor your personal information and alert you to potential misuse.
