Ukrainian law enforcement has announced that three individuals will stand trial for allegedly orchestrating a scheme to steal access to more than 610,000 **Roblox** accounts. Prosecutors in Ukraine’s western Lviv region detailed that the operation, which ran from May 2025 until April 2026, involved the theft of digital credentials, allowing unauthorized access to user accounts without requiring passwords. ### The Modus Operandi: Session Token Theft and Malware The core of the operation revolved around stolen session tokens, commonly known as cookies. By acquiring these tokens, attackers could bypass password authentication and take over active accounts. Authorities also revealed that the attackers distributed information-stealing malware. This malicious software was disguised as legitimate applications offering gaming advantages or free in-game bonuses, tricking users into compromising their systems. ### Monetization of Virtual Assets Once access was gained, the group allegedly used specialized software to analyze the compromised accounts for valuable virtual currency, rare in-game items, or other digital assets. This allowed them to prioritize accounts with higher resale potential. The most valuable accounts were sold individually, while less lucrative ones were bundled and sold in bulk or at a discount. Advertisements for the stolen accounts were primarily placed on Russian online platforms, with payments processed through cryptocurrency wallets. Some accounts reportedly fetched around 70 Russian rubles (approximately $0.80) each. ### The Alleged Ring and Financial Gains Prosecutors allege that a 19-year-old from Drohobych organized the operation, recruiting two 22-year-old associates. The organizer reportedly assigned tasks, managed server payments, oversaw sales, and distributed proceeds. His associates were responsible for running the website and **Telegram** channels used for advertising, communicating with buyers, and handling finances. Investigators estimate the sale of these compromised accounts could have generated roughly $480,000. They have traced nearly $54,000 in cryptocurrency proceeds that were converted into Ukrainian currency and transferred to the suspects' bank accounts. ### Charges and Potential Penalties All three suspects are currently in custody. They face a range of charges, including theft, money laundering, unauthorized interference with computer systems, and the illegal sale of restricted information. If convicted, the offenses carry a maximum sentence of 12 years in prison.