A new malware campaign is targeting Roblox players with fake installers for a popular third-party utility called Xeno Executor, according to research from Bitdefender. The malicious software, which has been active since early 2026, is designed to steal sensitive information and provide remote access to infected systems.
Xeno Executor is a tool that allows Roblox players to run custom scripts, often used for automation or in-game cheats. Because Roblox's anti-cheat mechanisms frequently detect and block existing versions of Xeno Executor, its developers regularly release updates. Threat actors exploit this by promoting "undetected" versions of the tool through gaming forums, Discord communities, and compromised or impersonated accounts.
Victims download ZIP archives or self-extracting archives that contain the fake Xeno installers. To appear legitimate, these packages often mimic the directory structure of a genuine Xeno installation, include authentic Lua scripts, and use plausible filenames. When users launch `xeno.exe`, believing it to be the legitimate executable, they instead initiate a multi-stage malware infection.
The initial malware loader first checks for a Java Runtime Environment (JRE) and extracts one if necessary. It then reads a local file containing validation keys for the attackers' command-and-control (C2) server. Subsequently, an obfuscated Java payload, disguised as `decompiler.exe`, is launched. This payload performs environment checks, registers the victim with the C2 server, and downloads the final malware.
The final payload is a Java-based Remote Access Trojan (RAT) and information stealer. Its capabilities include stealing browser data such as cookies and other stored user information from Chrome, Edge, Brave, Opera, and Vivaldi. It also targets online accounts and payment data, specifically from Discord, Roblox, Minecraft, and Microsoft Store tokens, as well as payment information linked to Discord and Microsoft Store accounts. The malware can also steal cryptocurrency wallet data, with dedicated functionality for Exodus Wallet and the ability to identify numerous other cryptocurrency wallets.
Beyond data theft, the malware provides extensive surveillance capabilities, including keylogging, mouse activity logging, screenshot capture, desktop streaming, and webcam access. It also enables full remote control over the compromised system, allowing attackers to upload and download files, execute PowerShell commands, and access an interactive remote shell.
Bitdefender researchers believe this campaign is an evolved version of one previously documented by ThreatLocker under the name Powercat. The current iteration features significant updates to the malware's capabilities and a new C2 infrastructure, indicating continuous development by the threat actors.
Bitdefender has released indicators of compromise (IoCs) for the campaign and advises Roblox players to avoid installing third-party tools from unverified sources.
