RESOLVING THE LEDGER
This is one outlet's own report from TechRadar — the article as it was filed. Other outlets are covering the same event; open the full story to compare every source side by side.
See the full story · 1 sources
Bitdefender reported Roblox players lured by a fake “undetected” Xeno Executor mod spreading malware
Infection chain delivers a Java‑based RAT and infostealer stealing browser data, online accounts, payment info, and crypto wallets
Malware also enables surveillance and remote control; campaign peaked in March 2026 and remains active against Roblox’s 82M players
Cybercriminals are targeting Roblox players with an infostealer and a Remote Access Trojan (RAT) malware that grants them full control over compromised computers, experts have warned.
Roblox is an online gaming platform, virtual universe, and game creation system where users play millions of games and user-generated mods. Among the mods is Xeno Executor, a utility that allows players to run scripts that automate certain actions or run custom code. Some players use Xeno Executor to run cheats, too.
Since it’s an unofficial script, Roblox does not allow it and blocks it whenever a new version is released. Now, security researchers Bitdefender have reported finding an “undetected” version being promoted on various gaming forums, Discord communities, and similar.
CornFlake and CocoShell
This version is advertised as “invisible” to Roblox’s anti-cheat systems, but in reality, all it does is trigger an infection chain that ends in a Java-based RAT and information stealer.
The malware grabs browser data such as passwords and cookies from some of the most popular browsers (Chrome, Edge, Brave, Opera, Vivaldi), as well as online accounts and payment data (Discord, Roblox, Minecraft, Microsoft Store tokens, and more).
It also steals cryptocurrency wallet data, particularly targeting the Exodus Wallet.
As for surveillance, it can log keys, track mouse movements, grab screenshots, stream whatever is on the desktop, and access the webcam. The crooks are also granted file upload and download, PowerShell command execution, and more.
The campaign was kicked off at the start of the year, reaching its peak in March, it was said. It has now stabilized and is still going relatively strong.
We don’t know exactly how many players fell victim to this campaign, but Roblox is an incredibly popular platform, so it is possible the campaign was rather successful, too.
According to Activeplayer , Roblox currently has more than 82 million active players.
AIPROPX is an independent multi-source news index — we track, compare, and connect coverage from across the web into one place you won't find anywhere else.