Roblox Scams Use Phishing, JavaScript and Stolen Session IDs to Hijack Accounts
Summary
Talos explains scams targeting Roblox players, including phishing, malicious JavaScript, API-form manipulation, HAR-file theft and malware, and recommends ways to protect accounts and avoid losing Robux or items.
Key points
- Fake free-Robux offers use phishing pages or in-game experiences to collect account credentials.
- JavaScript links and malicious bookmarks can steal a player’s session ID, enabling account access.
- Scammers can misuse a Roblox API form to get victims to accept a trade that transfers their items.
- HAR files shared under the pretext of creating avatar artwork may expose session IDs.
- Other tactics include rigged double trades and malware or browser extensions disguised as free rewards or development tools.
- Talos advises avoiding unsolicited links and downloads, suspicious offers, unusual browser actions and out-of-platform trades.
- Recommended safeguards include multifactor authentication, privacy and trading controls, and a PIN for changing settings.
Article Details
- Topic
- Scams targeting Roblox users, including phishing, session theft, fraudulent trades, and malware installation.