Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
2 IOCs

Fake Xeno Roblox Executor Delivers Java RAT Through Discord and Gaming Forums

Cyber Press
Cyber Press
Published August 4, 2026Original Report

Excerpt

A malware campaign is targeting Roblox players with a fake version of the Xeno script executor, a tool commonly used to run custom Roblox scripts. The malicious package is advertised as an “undetected” Xeno build. It is distributed through gaming forums, Discord communities, archives, and compromised accounts. Researchers at Bitdefender said the campaign uses a multi-stage Java-based infection chain designed to appear to be a normal Xeno installation. While victims believe…

Read the original report →

Indicators of Compromise

Open the mindmap →

2 indicators

TypeIndicatorConfidenceScoreFirst Seen
MD59930036e8f787674db39094e21413e77HighScore 59/100First seen
MD54bdaf7792e908f163ebef137854c571dHighScore 59/100First seen

IOC Relationship Graph

Building graph…