cyber.hendryadrian.com
Security News · bleepingcomputer.com

Fake Roblox Xeno Installers Deliver Java RAT and Infostealer

· Original article ↗

Summary

Bitdefender reports fake Xeno Executor installers targeting Roblox users with a Java RAT and infostealer. The malware can steal browser data, tokens and wallet information, conduct surveillance, and enable remote control.

Key points

  • Fake installers are promoted through gaming forums, Discord communities, and compromised or impersonated accounts.
  • The packages imitate a legitimate Xeno installation and launch a first-stage loader when users run xeno.exe.
  • The loader checks for Java, then launches an obfuscated payload that registers the victim and downloads the final malware.
  • The Java-based RAT and infostealer targets browser data, account tokens, payment information, and cryptocurrency wallets.
  • Its surveillance and remote-access capabilities include keylogging, screenshots, webcam access, file transfers, and remote shell access.
  • Bitdefender says the campaign may be related to previously documented Powercat activity, but uses updated malware and new C2 infrastructure.
  • Bitdefender shared indicators of compromise and advises players to avoid third-party tools from obscure sources.

Article Details

Event Type
Malware campaign distributing fake Xeno Executor installers to Roblox users
Impact
The Java-based RAT and information stealer can steal browser data, game and account tokens, payment information, and cryptocurrency wallet data. It also supports keylogging, screenshots, webcam access, file transfers, PowerShell command execution, and remote shell access.

MITRE ATT&CK

T1056.001 · KeyloggingThe malware includes keylogging capability.T1059.001 · PowerShellThe malware enables attackers to execute PowerShell commands.T1105 · Ingress Tool TransferThe malware downloads the final payload after registering the victim.T1113 · Screen CaptureThe malware can capture screenshots.T1125 · Video CaptureThe malware can access the victim's webcam.T1204.002 · Malicious FileVictims are tricked into running the fake Xeno executable, which launches the first-stage malware loader.T1528 · Steal Application Access TokenThe malware targets tokens associated with Discord, Roblox, Minecraft, and Microsoft Store accounts.T1555.003 · Credentials from Web BrowsersThe malware steals cookies and other stored browser data.

Products

RobloxFake Xeno Executor installers are being used to trick Roblox players into installing malware that steals sensitive data and gives attackers remote access.Xeno ExecutorFake Xeno Executor installers are being used to trick Roblox players into installing malware that steals sensitive data and gives attackers remote access.