Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums

Bitdefender researchers describe an active malware campaign that lures gamers with a fake “undetected” Xeno Roblox script executor. The multi-stage Java infection chain installs a sophisticated stealer/RAT that can harvest browser cookies, Discord/Roblox/Minecraft accounts, cryptocurrency wallet data, payment tokens, and also perform keylogging, webcam capture, desktop streaming, file operations, PowerShell execution, persistence, and self-updating via C2 infrastructure; the report includes technical analysis, sandbox-evasion checks, persistence details, and IoCs (file hashes, URLs, and a dynamically generated C2 domain).