A new threat campaign is actively leveraging fake installers of **Xeno Executor**, a popular third-party scripting utility for **Roblox**, to infect users with a potent combination of infostealer and remote access trojan (RAT) malware. **Bitdefender** researchers have been tracking this campaign since the beginning of the year, noting a significant surge in activity in March that has since stabilized. ## How the Attack Unfolds The attackers disseminate the malicious **Xeno Executor** installers through various channels, including gaming forums, **Discord** communities, and compromised or impersonated accounts. They specifically target users seeking an "undetected" version of **Xeno**, capitalizing on the tool's ongoing cat-and-mouse game with **Roblox**'s anti-cheat mechanisms. Victims typically download ZIP archives or self-extracting archives that contain the fake installer along with seemingly legitimate instructions. To enhance authenticity, the threat actors meticulously recreate the directory structure of a genuine **Xeno** installation, embed authentic Lua scripts, and use plausible filenames. Once a user executes the deceptive `xeno.exe` file, believing it to be the legitimate tool, the initial malware loader is launched. ## Multi-Stage Infection Process The infection process is multi-staged: 1. **Java Runtime Environment Check**: The initial payload verifies the presence of a Java Runtime Environment (JRE) and extracts one if necessary. 2. **C2 Validation**: It then reads a local file containing validation keys required to connect with the attackers' command-and-control (C2) server. 3. **Obfuscated Java Payload**: An obfuscated Java payload, disguised as `decompiler.exe`, is subsequently launched. This payload performs environment checks, registers the victim with the C2 server, and downloads the final malware.  ## Capabilities of the Final Payload The final payload is a sophisticated Java-based RAT and information stealer, boasting a wide array of capabilities: * **Browser Data Theft**: Steals cookies and other stored user data from web browsers such as **Chrome**, **Edge**, **Brave**, **Opera**, and **Vivaldi**. * **Online Account & Payment Data**: Targets online accounts including **Discord**, **Roblox**, **Minecraft**, **Microsoft Store** tokens, and associated payment information. * **Cryptocurrency Wallet Data**: Possesses dedicated functionality to target **Exodus Wallet** and identify numerous other cryptocurrency wallets. * **Surveillance Capabilities**: Implements keylogging, mouse activity logging, screenshot capturing, desktop streaming, and webcam access. * **Full Remote Control**: Allows attackers to upload and download files, execute **PowerShell** commands, and access an interactive remote shell. ## Evolving Threat **Bitdefender** suggests that this campaign is an evolved version of one previously documented by **ThreatLocker** under the name “**Powercat**.” The new campaign features significant updates to the malware's capabilities and a new C2 infrastructure, indicating continuous development by the threat actors. **Bitdefender** has released Indicators of Compromise (**IoCs**) for this campaign. The cybersecurity firm strongly advises **Roblox** players and users of similar platforms to exercise extreme caution and avoid installing third-party tools from unverified or obscure sources to mitigate the risk of infection.