Malware Disguised As Roblox Cheat Tool Hijacks Webcams And Steals Credentials, Bitdefender Finds

Cybersecurity firm, Bitdefender, has uncovered an active malware campaign that spreads through gaming forums and Discord communities, targeting players searching for Roblox game modifications and cheats.

The malware is packaged as a modified version of Xeno, a script executor used within Roblox. It is marketed on forums as an “undetected” tool, making it attractive to players looking to gain an in-game advantage. Once installed on a victim’s machine, it gives attackers live access to the victim’s webcam, streams their desktop in real time and logs every keystroke.

Because Roblox attracts a younger audience, infections frequently land on shared family computers, putting household financial data and private conversations at risk alongside children’s gaming accounts.

How the malware hides

The malware conceals itself inside a folder associated with XBox Game Bar, a built-in Windows feature. It uses file names designed to mimic standard Windows components, making it difficult for users to identify as malicious software through casual inspection of their file system.

This approach allows the malware to blend into the operating system’s existing directory structure. For users unfamiliar with the technical layout of their machines – a category that includes many younger players and their parents – the presence of the malicious files is unlikely to raise suspicion.

A broad range of accounts targeted

The campaign reaches well beyond Roblox credentials. The malware harvests account information from a range of gaming platforms and services including Discord, Minecraft, Steam, Epic Games, Battle.net and Riot.

For Minecraft specifically, the malware targets credentials across six separate launchers including Lunar, Prism and the official Minecraft client, broadening the scope of potential data theft for players who may use multiple clients to access the game.

Browser data is also collected from Chrome, Edge, Brave, Opera and Vivaldi, giving attackers access to saved passwords, cookies and browsing history stored across these platforms.

Cryptocurrency wallets and payment tokens

The malware further targets cryptocurrency wallets, with a particular focus on Exodus. Bitdefender’s research indicates the malware actively tampers with Exodus to intercept wallet data at runtime, rather than simply copying stored credentials. This represents a more aggressive approach than passive credential theft, as it allows attackers to capture transaction data as it is being processed.

Microsoft Store payment tokens are also harvested, adding another avenue for financial exploitation beyond gaming accounts.

Risk to families and younger players

Roblox cheat tools are predominantly sought out by younger players, many of whom use shared family computers. A single infection can expose not only a child’s gaming accounts but also a parent’s banking credentials, email accounts and other data stored on the same machine.

The distribution channels for the malware – gaming forums and Discord servers – are spaces commonly frequented by teenagers and children, making this demographic particularly exposed to the campaign. The promise of an undetectable cheat tool serves as an effective lure for players who may not have the technical awareness to recognise the risks involved in downloading and installing unverified software.

Connection to previously documented campaign

Other security researchers had previously identified elements of this campaign under the name Powercat. Bitdefender’s own telemetry, however, revealed additional command-and-control domains and capabilities that extend beyond what was previously documented.

The presence of new infrastructure and expanded functionality suggests the malware is still under active development and continues to be deployed in cybercriminal operations, rather than being a static or abandoned threat. Bitdefender’s findings point to an ongoing evolution of the campaign’s tooling and reach.

Implications for Australian households

With Roblox maintaining a large player base among younger Australians, the campaign presents a direct risk to households where children may be downloading game modifications without parental oversight.

The combination of webcam access, real-time desktop streaming and keystroke logging gives attackers a comprehensive window into a victim’s digital life, extending well beyond the gaming accounts that initially drew the target to download the malware. For families sharing a single computer, the potential exposure spans every account and credential stored on that device.