Fake Xeno Roblox Executor Delivers Java RAT Through Discord and Gaming Forums

A malicious campaign is distributing a fake “undetected” Xeno Roblox script executor via forums, Discord, archives, and compromised accounts; the installer uses a multi-stage Java-based loader (including an embedded JRE) to deploy a Powercat JavaRAT that steals browser cookies, Roblox/Discord/Minecraft tokens, cryptocurrency wallet data, and can log keystrokes, capture screenshots and webcam, stream the desktop, and provide remote shell/file operations. Bitdefender observed active development and new C2 infrastructure, and recommends blocking the identified infrastructure, hunting for suspicious Java execution under %LOCALAPPDATA%\, reviewing Run-key entries named Display Calibration, avoiding unofficial cheats, enabling MFA, and using updated endpoint protection.