security researchers

Roblox is facing privacy concerns due to spyware disguised as an "undetected" version of the Xeno Roblox cheat tool. This malware can access screens, record keystrokes, and activate webcams, allowing attackers to execute remote commands. The infection begins when users download a file resembling a legitimate Xeno installation, often shared on platforms like Discord. The malware, previously known as Powercat, has evolved and operates in three stages: 1. The user executes a file named Xeno.exe, which checks for Java and extracts it if necessary. 2. The malware runs a JAR file disguised as decompiler.exe, performing checks to avoid detection. 3. It masquerades as a legitimate Windows DLL file, logging activities and attempting to escalate privileges. If successful, the malware can control the victim's system, access webcams, log keystrokes, and steal sensitive information, including cryptocurrency wallet credentials. To protect against this spyware, users are advised to avoid unofficial cheats, use antivirus software, refrain from clicking unsolicited links, enable two-factor authentication, inspect User Account Control prompts, and consider identity theft protection services.