A counterfeit version of a popular Roblox cheat tool is giving attackers hands-on control of players' computers, and Bitdefender warns that the people most likely to install it are children and teenagers using shared family machines.
Bitdefender researchers Janos Gergo Szeles and Silviu Stahie published their analysis on 3 August 2026. The campaign impersonates Xeno, a widely used Roblox script executor, and is advertised as an undetected build, which is exactly what a player who keeps getting blocked by the game client wants to hear. The fake packages circulate on gaming forums and in Discord communities, posted either by the operators themselves or through compromised and impersonated accounts.
Who is affected
Bitdefender's telemetry shows users have been hit since the beginning of the year, with activity rising sharply in the second half of March and holding at a fairly steady rate since. ThreatLocker researchers previously documented the same campaign under the name Powercat; Bitdefender says it has since found additional command and control infrastructure and extra capabilities, which suggests the malware is still being actively developed.
The stakes are higher than a lost game account. Because the malware harvests browser cookies and payment-related tokens from whatever machine it lands on, a child installing a cheat on a family PC can expose a parent's logged-in sessions, saved payment details and private conversations.
How the attack works
The archive the victim downloads is built to look like a real Xeno installation, down to genuine LUA scripts taken from the legitimate tool and filler files such as RbxAnalytics.png that contain nothing but ten bytes of junk. The user is told to run the entry point at %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe, which is the first stage of the malware rather than the cheat.
From there the chain is Java, not the usual Windows executable. The loader checks whether a Java runtime already sits at %LOCALAPPDATA%\Java\jre\bin\javaw.exe and, if not, unpacks its own copy using a hidden PowerShell command. It then reads keys out of a file named XenoIcon.jpg and passes them to a JAR masquerading as decompiler.exe, whose bytecode is scrambled with a demo copy of Allatori, a legitimate commercial obfuscator the authors are abusing.
Before it does anything else, that JAR checks whether it is being watched. It looks for debugger arguments such as jdwp and suspend, for analysis tools including IntelliJ, Eclipse, NetBeans and Bytecode Viewer in the stack trace, for disks smaller than 20 GB, for MAC addresses belonging to virtual network adapters, and for virtual machine traces in the registry and WMI. The results are posted to the server, which then decides whether the machine deserves a payload at all. Later stages hide behind Windows-style DLL names and sit in trusted-looking directories, including a folder associated with Xbox Game Bar, formerly Microsoft GameDVR.
The final payload is a stealer and remote access trojan in one. Bitdefender says it takes browser cookies, Discord, Roblox and Minecraft accounts, cryptocurrency wallet data and payment information, and goes well beyond theft: it can record keystrokes, access the webcam, stream the victim's desktop, manipulate files, run PowerShell commands and give the attacker interactive control of the machine.
Indicators
Bitdefender lists the following defanged command and control endpoints: hxxps://solthere[.]net/justacoolkat10 for the initial check-in, and hxxps://solthere[.]net/api/v1/redeem for payload retrieval.
What you should do
The blunt advice is that there is no such thing as an undetected cheat build, and anything advertised that way on Discord should be assumed hostile. On a machine you suspect, look for an unexpected Java runtime under %LOCALAPPDATA%\Java\jre and for a Xeno folder under %LOCALAPPDATA%. If it did run, changing passwords is not enough on its own: stolen cookies mean live sessions, so sign out of all devices on Discord, Roblox, Minecraft and any browser-synced accounts, and check for saved payment methods and wallet files. This is the same playbook attackers used in an earlier campaign where fake game downloads delivered an infostealer, and gaming communities remain an efficient way to reach victims who install unsigned software by habit.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.