Roblox Developer Group Takeovers via Malicious 'robase' Python Package and Discord Job-Offer Social Engineering

Roblox Developer Group Takeovers via Malicious 'robase' (TL-2026-0851), also tracked as robase campaign, is a high-severity malware campaign, first published 2026-06-18. It has no confirmed attribution, affects Roblox Corporation Roblox developer accounts / groups / games, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0851

Threat ID
TL-2026-0851
Also known as
robase campaign, Roblox game takeover malware, CheesyStudiosOfficial takeover
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-18
Last reviewed
2026-06-18
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
gaming, online entertainment, independent game developers, creator economy
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Roblox Developer Group Takeovers via Malicious 'robase'

Malware and tooling: BAT/Obfuscated.AW, VBS/Pterodo.AOV, roboat plugin

A financially-motivated campaign tricks Roblox game developers into installing a malicious Python package ('robase') via fake Discord recruiter job offers impersonating studios such as Cheesy Studios. The malware is a session-token stealer that harvests authenticated Roblox (.ROBLOSECURITY) and Discord sessions, bypasses 2FA by session reuse, alters security settings, and lets attackers transfer game/group ownership and drain Robux.

How Roblox Developer Group Takeovers via Malicious 'robase' works

Beginning in early 2026, attackers have shifted from stealing individual Roblox players' high-value items ('beaming') to seizing entire revenue-generating games and developer groups. The intrusion begins with social engineering on Discord: an actor posing as a recruiter (e.g., Discord handle 'jivedevs') offers a developer a project-manager role at a real-sounding studio (impersonating 'Cheesy Studios' / the Matziaris family's CheesyStudiosOfficial group) to lend credibility, then asks the target to install a Python package named 'robase', described as a 'database tool' or part of the studio's project tooling. In other observed cases the payload is disguised as a 'Python launcher' or a 'roboat plugin'.

Upon execution the package functions as an infostealer focused on session-token theft rather than password theft. It reads authenticated browser sessions and cookies (the campaign specifically abuses the Roblox '.ROBLOSECURITY' session cookie and the Discord token), exfiltrating them to attacker infrastructure. Because the stolen artifacts are already-authenticated sessions, the attacker bypasses two-factor authentication entirely — victims report being logged out of Roblox on both PC and phone, their Discord account compromised, and their 2-step verification and passkey changed without consent. Reported persistence and execution artifacts on at least one victim host include Windows Task Scheduler entries invoking 'applicationbackup_.vbs' which in turn launches 'rEgX.cmd'; endpoint products flagged components as 'BAT/Obfuscated.AW' and 'VBS/Pterodo.AOV'. Targeted browsers include Opera (and, in the broader family of Roblox PyPI stealers, Chrome, Edge, Chromium and Firefox via the 'browser_cookie3' technique that parses '.ROBLOSECURITY=' values for exfiltration to Discord webhooks).

With control of the developer's account, attackers transfer group ownership to an attacker-controlled Roblox account (e.g., '@zetuisgod', user ID 715202, alias 'blockbound_rejection'), move the victim's flagship games into a copycat group ('Official Cheesy Studios', group ID 14957066), drain the group's Robux balance, and ban or remove the original owners. Confirmed victims include the Matziaris brothers' CheesyStudiosOfficial group (ID 7408043, 12,300+ members) whose games 'Backrooms: The Shadow Network' (20,000+ likes) and 'Chrono Battlegrounds Unlimited' (78,300+ visits) were hijacked on 4 April 2026; developer Mohamed Kaparoza (the robase-named case); and 15-year-old developer Jovan Rai, whose game 'Overcoding Overseers' generated ~10,000 Robux/day with ~1,100 concurrent users. Roblox initially declined to restore games until 404 Media made inquiries, then stated it was 'troubled' and restored at least one game, while noting that 'no security measure can completely eliminate the risk of account theft when users are persuaded to run malicious software.'

MITRE ATT&CK techniques used in TL-2026-0851

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal

Persistence

T1053 Scheduled Task/Job

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Discovery

T1217 Browser Information Discovery

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Impact

T1531 Account Access Removal; T1657 Financial Theft

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Roblox Developer Group Takeovers via Malicious 'robase'

  • Roblox Corporation — Roblox developer accounts / groups / games
    Vulnerable versions: all developer accounts targeted via social engineering
  • Python Software Foundation — PyPI ecosystem (malicious package 'robase')
    Vulnerable versions: robase (malicious package)
  • Discord — Discord accounts (session token theft)
    Vulnerable versions: accounts on hosts running robase

Remediation for Roblox Developer Group Takeovers via Malicious 'robase'

Immediate actions

  • Never run an unsolicited file, 'database tool', custom installer, or Python package sent by a stranger via Discord job offer
  • Treat the 'robase' package and any 'roboat plugin' / 'Python launcher' delivered through recruiter DMs as malicious; do not install
  • If installed, immediately log out all sessions, rotate the .ROBLOSECURITY cookie by signing out everywhere, reset Roblox and Discord passwords, and reconfigure 2FA/passkey from a clean device
  • Review active Roblox sessions and authorized devices; revoke unknown sessions
  • File a Roblox support ticket documenting the ownership transfer and Robux theft with timestamps

Workarounds

  • Vet recruiter/job offers out-of-band; verify studio identity through official channels before running any code
  • Use a dedicated, hardened browser profile for Roblox Studio with no third-party tooling

Longer-term hardening

  • Test unfamiliar software only in an isolated VM or sandbox, never on a host with logged-in Roblox/Discord sessions
  • Deploy endpoint security with real-time protection and PyPI/dependency scanning in developer workflows
  • Enable and monitor Roblox group audit logs and account-activity alerts for ownership/role changes
  • Educate developer teams that session-token theft bypasses 2FA, so 2FA is not sufficient protection against running malware

Weaknesses (CWE) in Roblox Developer Group Takeovers via Malicious 'robase'

CWE-506, CWE-829, CWE-522, CWE-294

Timeline of Roblox Developer Group Takeovers via Malicious 'robase'

  • Sonatype and Snyk Labs disclose malicious PyPI packages that steal the Roblox .ROBLOSECURITY cookie and Discord tokens and exfiltrate them to Discord webhooks — the technical precursor family to the 2026 robase campaign.
  • Reporting (404 Media, Malwarebytes) notes the threat actors shifting in early 2026 from 'beaming' individual players' high-value items to seizing entire revenue-generating games and developer groups via malware-driven account takeover.
  • Games 'Backrooms: The Shadow Network' and 'Chrono Battlegrounds Unlimited' transferred; original owners removed/banned; child-safety-violating content uploaded to associated Discord.
  • Attacker '@zetuisgod' (ID 715202, alias 'blockbound_rejection') transferred group ownership, drained Robux, and moved games into copycat group 'Official Cheesy Studios' (ID 14957066).
  • CheesyStudiosOfficial group (ID 7408043) compromised ~02:00-03:00 GMT+3 after a son was lured by Discord recruiter 'jivedevs'; attacker ran malicious file disguised as a Python/roboat tool.
  • Victims including Jovan Rai report fighting Roblox support for 30+ days to recover hijacked games and Robux.
  • Malwarebytes publishes analysis confirming session-token theft (not password theft), 2FA/passkey changes, and recommends sandbox testing of unsolicited tools.
  • 404 Media publishes 'Hackers Are Hijacking Entire Roblox Games Now', documenting the robase package and multiple developer victims; Roblox restores at least one game after inquiry.
  • Help Net Security reports on the robase Roblox game-takeover campaign and Roblox's statement that it was 'troubled' by the incidents.

Sources cited for Roblox Developer Group Takeovers via Malicious 'robase'

Threats related to Roblox Developer Group Takeovers via Malicious 'robase'

Detection coverage for TL-2026-0851

As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0851 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats