# Infostealer Campaign Targeting Roblox Developers via Malicious 'robase' Python Package and Fake Discord Job Offers

> An active social-engineering campaign targets Roblox game developers with infostealer malware delivered through fake Discord project-manager job offers and studio impersonation, distributing a malicious Python package named 'robase'. The malware steals authenticated browser sessions and the .ROBLOSECURITY token to bypass two-factor authentication, enabling theft of developer accounts, group ownership, entire published games, and Robux balances.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0845
- **ID:** TL-2026-0845
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since at least early 2026, threat actors have been running a persistent, financially and ownership-motivated social-engineering campaign against Roblox developers. The attack begins on Discord: operators pose as recruiters or legitimate game studios (e.g., impersonating 'Cheesy Studios') and dangle a paid project-manager role. After building rapport, they ask the target to 'install a Python package' or 'run a particular file' as part of supposed internal database or project tooling. The package named in confirmed victim accounts is 'robase', described to the victim as a 'database tool'. Shortly after installation, victims are forcibly logged out of Roblox on both PC and mobile, with attackers proceeding to seize the account, the developer group, the published game(s), and any Robux balance.

The core technique is session-token / cookie theft rather than password theft. Infostealers grab the authenticated browser session and the Roblox .ROBLOSECURITY cookie (and frequently Discord tokens), which are presented directly to the platform's servers — making two-factor authentication (2FA) irrelevant because the attacker is already authenticated as the victim. This same session-hijacking pattern lets the attacker pivot across Roblox, Discord and other accounts the stealer harvests.

The 'robase' lure sits within a broader, well-documented ecosystem of supply-chain attacks on the Roblox developer community across PyPI and npm. Related campaigns have published typosquatted/impersonating packages — including npm packages node-dlls, ro.dll, autoadv and two versions of rolimons-api — that deliver the Go-based Skuld infostealer and the Python-based Blank Grabber, and PyPI packages embedding a 'Discord Injector' that exfiltrates Discord tokens and skims payment-card data. These payloads commonly pull secondary executables and tooling from the Discord CDN and GitHub, and exfiltrate harvested data over Discord webhooks. Documented victims of the current Roblox-developer wave include 'The Shadow Network' (a game built by the Matziaris brothers), a 15-year-old developer (Jovan Rai) who was earning roughly 10,000 Robux/day and needed 30+ days to recover, and developer Mohamed Kaparoza, who documented the Discord-to-robase attack chain.

Mitigation centers on treating unsolicited Discord job offers that request software installation as hostile, testing unknown packages only in isolated virtual machines, reviewing and revoking active Roblox/Discord sessions, enabling Roblox 'Enhanced Protection' / account-security features, and deploying real-time endpoint malware detection. Because the attack defeats 2FA through stolen session material, response must include immediate session revocation and credential rotation, not just a password reset.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1036 Masquerading
- T1550 Use Alternate Authentication Material
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal

## Sources

- [Roblox developers are losing entire games to malware attacks](https://www.malwarebytes.com/blog/scams/2026/06/roblox-developers-are-losing-entire-games-to-malware-attacks)
- [Hackers Are Hijacking Entire Roblox Games Now](https://www.404media.co/hackers-are-hijacking-entire-roblox-games-now/)
- [Roblox Developers Targeted with npm Packages Infected with Infostealers](https://socket.dev/blog/roblox-developers-targeted-with-npm-packages-infected-with-infostealers)
- [Malicious npm Packages Target Roblox Users with Data-Stealing Malware](https://thehackernews.com/2024/11/malicious-npm-packages-target-roblox.html)
- [Roblox and Discord Become Virus Vectors for New PyPI Malware](https://thenewstack.io/roblox-and-discord-become-virus-vectors-for-new-pypi-malware/)
- [Whack-a-Mole: More Malicious PyPI Packages Spring Up Targeting Discord, Roblox](https://www.darkreading.com/application-security/whack-a-mole-malicious-pypi-packages-target-discord-roblox)
- [Snyk finds PyPI malware that steals Discord and Roblox credential and payment info](https://labs.snyk.io/resources/pypi-malware-discord-roblox-credential-payment-info/)
- [From Cookies to Keys: The Threat of Session Hijacking (session-token / 2FA bypass background)](https://www.huntress.com/blog/why-hackers-don't-need-passwords-anymore)
- [Powercat malware campaign: Fake game cheats deliver infostealer targeting Discord, Roblox, and crypto wallets](https://www.threatlocker.com/blog/powercat-malware-campaign-fake-game-cheats-deliver-infostealer-targeting-discord-roblox-and-crypto-wallets)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0845