Malware News In Bitdefender's latest report a Fake Xeno Roblox cheat delivers a Java-based RAT/stealer with webcam access, desktop streaming, and interactive shell

[Khushal]

Content source

https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor

Campaign active since early 2026, targeting gamers including minors, previously tracked as Powercat.

- Entry point is %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe, a fake loader that extracts a bundled JRE to %LOCALAPPDATA%\Java\jre\bin\javaw.exe, reads keys from XenoIcon.jpg, then executes decompiler.exe (a JAR obfuscated with Allatori). Stage 2 phones home to hxxps://solthere[.]net/api/v1/redeem with an AES+Base64-encrypted key to pull the next payload.

- Stage 3 drops into %LOCALAPPDATA%\Microsoft\GameDVR under a fake Windows DLL name and persists via HKCU\Software\Microsoft\Windows\CurrentVersion\Run as "Display Calibration". It attempts CMSTP UAC bypass for elevation and generates its C2 URI dynamically: ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a[.]xyz.

- Capabilities go well beyond credential theft: keylogging, 500ms desktop streaming, webcam capture via DirectShow COM objects, interactive PowerShell shell, and Exodus wallet tampering by injecting JS into app.asar and logging runtime data to SquirrelInteractive.bin.

Hunt for javaw.exe spawned from %LOCALAPPDATA%, "Display Calibration" Run key entries, -ntcache log files in user home, and SquirrelInteractive.bin. Full IOC list with MD5 hashes in the Bitdefender report.

Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums

A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players

www.bitdefender.com

 

[Bot]

Assessment

The quoted Bitdefender report describes a multi-stage infostealer/RAT targeting gamers, with persistence, surveillance, remote shell access, and cryptocurrency-wallet tampering. The listed indicators should be treated as compromise indicators rather than proof that every matching file is malicious; legitimate Java installations and Windows entries can also create false positives.

If infection is suspected

• Disconnect the affected system from the internet, while avoiding unnecessary shutdowns if forensic preservation is important.
• Do not launch, delete, or upload suspected files manually. Preserve their paths, timestamps, hashes, and relevant logs.
• From a clean device, change passwords for email, Discord, Roblox, gaming platforms, and financial services. Revoke active sessions and regenerate MFA recovery codes where applicable.
• Treat cryptocurrency-wallet credentials and browser-stored secrets as exposed. Move assets to a newly secured wallet only after confirming the device is clean, and contact the wallet provider if unauthorized activity occurred.
• Run an offline scan and a full scan using reputable security software. A second-opinion scanner can be useful, but multiple simultaneous real-time antivirus products should be avoided.
• For a confirmed compromise involving keylogging, webcam access, PowerShell, and wallet modification, the most reliable remediation is backing up only personal documents and performing a clean operating-system installation.

Useful checks

Review these locations and indicators, without executing anything found there:

• %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe
• %LOCALAPPDATA%\Java\jre\bin\javaw.exe
• %LOCALAPPDATA%\Microsoft\GameDVR
• The HKCU\Software\Microsoft\Windows\CurrentVersion\Run value named Display Calibration
• -ntcache files in the user profile
• SquirrelInteractive.bin
• Unexpected javaw.exe processes whose command line points into a user-writable AppData directory

The Bitdefender article and its included hashes should be used as the authoritative source for the complete IOC set. Hash matches should be verified against the exact file and path, preferably with VirusTotal or another reputable analysis service; an IOC match alone does not establish the full scope of compromise.

The safest conclusion is to handle a confirmed match as a serious compromise, isolate the system, rotate credentials from a clean device, and use professional incident-response assistance or a clean reinstall when wallet data or sensitive accounts may have been exposed.