Fake Xeno and Roblox Utilities Used to Install Windows RAT, Microsoft Warns

Microsoft Threat Intelligence observed a campaign that distributes trojanized gaming executables (e.g., Xeno.exe, RobloxPlayerBeta.exe) which act as downloaders to install a portable Java runtime and launch a malicious jd-gui.jar, ultimately deploying a remote access trojan. The attackers leverage PowerShell and trusted Windows binaries (LOLBins), persist via scheduled tasks and a startup script (world.vbs), and modify Microsoft Defender exclusions to evade detection; the report includes associated domains and endpoints for detection and blocking.