Anyone hunting for an "undetected" version of Xeno, a popular Roblox script executor, is walking into a trap. Bitdefender Labs has documented a campaign that dresses malware up as the cheat tool, then installs a Java-based stealer and remote access trojan that can log your keystrokes, stream your desktop, and switch on your webcam.
The lure is well chosen. Xeno is real software that Roblox players use to run scripts the game does not allow, so people looking for it are already prepared to click past antivirus warnings — and are specifically searching for a build that anti-cheat will not detect. That is exactly what the attackers advertise.
How the fake Xeno installer works
Bitdefender's analysis breaks the infection into three stages, each designed to look like a normal installation.
- xeno.exe — the initial loader. It unpacks a Java Runtime Environment and starts the next stage.
- decompiler.jar — the checker. It looks for debuggers and sandbox environments (the isolated virtual machines security researchers use to safely run suspicious files), and only then contacts its command-and-control server to fetch the real payload.
- GameDVR JAR — the payload. A full stealer and remote access trojan.
That middle stage is why casual analysis misses it. If the malware thinks it is being watched, it simply does not download the dangerous part.
What the malware can do
Once the third stage lands, the operator effectively has the PC. Bitdefender lists keylogging and mouse-activity logging, screenshot capture, real-time desktop streaming at 500-millisecond intervals, display enumeration, and webcam access through Windows DirectShow components. On top of the surveillance, it offers file upload, download and renaming, PowerShell command execution, and an interactive remote shell.
It also reaches for Microsoft Store payment information.
What it steals
The credential theft is broad rather than targeted:
- Browsers: Brave, Chrome, Edge, Opera, Opera GX, and Vivaldi — cookies and stored logins.
- Gaming: Steam, Roblox, Minecraft, Epic Games, Battle.net, and Riot Client, including tokens and session data that allow account takeover without a password.
- Messaging: Telegram, Discord, WhatsApp, and Snapchat.
- Crypto wallets: Exodus, Atomic, Cake Wallet, SafePal, TronWallet, and Monero.
- VPNs: NordVPN, Mullvad, ExpressVPN, and Surfshark.
- Game launchers: Feather, Lunar, Meteor, Modrinth, and Prism.
Session tokens are the nastiest item on that list. A stolen token can let an attacker walk straight into a Discord or Roblox account without ever needing the password, which is also why changing your password alone may not lock them out.
The campaign has been running all year
This is not a new outbreak. Bitdefender says the activity has been live since early 2026, rising sharply in the second half of March before settling, and is still being developed. It spreads through gaming forums, Discord communities, file-sharing sites, and compromised or impersonated accounts — the same places players go looking for cheats. Researchers at ThreatLocker previously documented related tooling under the name Powercat, and the samples use the Allatori obfuscator to make the Java code harder to read. Bitdefender did not publish victim counts or a country breakdown.
Why Filipino families should pay attention
Roblox is not a niche platform in the Philippines. The country is among the game's largest user bases, and it has been the subject of sustained government attention: regulators weighed restrictions before choosing tighter safeguards instead, and a Senate inquiry led by Senator Risa Hontiveros put the platform's child-safety record on the record.
Roblox's own response has been structural. It rolled out age-based account tiers from June 2026 — Roblox Kids for ages 5 to 8, with communication features off by default, and Roblox Select for ages 9 to 15 with curated access — alongside facial age checks for chat. Chief safety officer Matt Kaufman described safety as "a journey," not a fixed feature.
But none of those controls touch this threat. Age tiers and chat filters govern what happens inside Roblox. A fake Xeno installer runs on the Windows PC outside it, and it is a household risk rather than a child-safety one: the same infection that takes a teenager's Roblox account also reaches the family's saved browser passwords, the parent's Telegram session, and any crypto wallet on the machine. On a shared home PC — still the normal setup in many Filipino households — one download compromises everyone who uses it.
The defence is unglamorous. Cheat tools and "undetected" executors are among the most reliable malware delivery routes aimed at young players. If a machine has already run one, treat it as compromised: scan it, sign out of all sessions on every affected service rather than only changing passwords, and check whether any wallet or payment method was stored on it. Roblox itself is also pushing into new territory with its text-prompt game creation alpha, which will only widen the audience these campaigns are fishing in.
