News ·
Fake Roblox cheat tool steals passwords and accesses the webcam
By Liska, has been playing Roblox and Murder Mystery 2 for almost three years
Security researchers have found a tampered version of the well known Roblox script tool Xeno. Anyone who runs it installs malware on their computer that records keystrokes and harvests login details.
A tool doing the rounds that promises an advantage in Roblox actually does something quite different: it gives strangers access to the whole computer. The security company Bitdefender examined a tampered version of the script tool Xeno and published its findings in early August 2026, first picked up in Germany by the trade outlet netzpalaver.
The file is passed around on Discord servers and gaming forums, often in groups that revolve around exactly these kinds of tools.
What the program really does
Anyone who runs the file unknowingly installs a piece of malware. According to the analysis, it does a great deal at once:
- It records what is typed on the keyboard, passwords included.
- It accesses the webcam and records.
- It films the screen.
- It takes the saved logins out of the browser, among them Chrome, Edge, Opera, Brave and Vivaldi.
- It specifically looks for login details for Roblox, Discord and Minecraft.
- It harvests payment details.
The program hides itself in several layers so that virus scanners have a harder time with it. The first sighting came from the company Threatlocker, and Bitdefender has documented new servers behind it since March 2026. So the whole thing is still running.
Why it is children who are affected
That is no accident. Anyone looking for shortcuts in games, for scripts, for free Robux, ends up in exactly these groups very quickly. The people behind it know that. They pick out those who want to download something they are not really allowed to download, and who therefore ask nobody.
We deliberately name the tool here without a link. Anyone who is not looking for it should not find it either.
What you can do
Beforehand: install nothing that promises an advantage in a game. Roblox forbids such programs anyway, and an account can be banned for using them. The real damage, though, is to the computer, not the ban.
If it has already happened: disconnect the computer from the internet, run a full virus scan, then change the passwords from a different device. The Roblox account first, then email, Discord and everything that was saved in the browser. Switch on two-factor login and sign out of all open sessions. If payment details were stored in the browser, go through the statements over the coming weeks. And tape over the webcam until the virus scan is done, which sounds old-fashioned and helps all the same.
How to secure the Roblox account is set out step by step on Is Roblox safe for kids?. Why the promises of free Robux cannot work either is explained in Are there free Robux codes?.
One more thing for everyone who plays: there is no shame in having fallen for something like this. These programs are built to look genuine. It only becomes embarrassing if fear keeps you quiet and the stranger carries on undisturbed.