# Roblox Developer Group Takeovers via Malicious 'robase' Python Package and Discord Job-Offer Social Engineering

> A financially-motivated campaign tricks Roblox game developers into installing a malicious Python package ('robase') via fake Discord recruiter job offers impersonating studios such as Cheesy Studios. The malware is a session-token stealer that harvests authenticated Roblox (.ROBLOSECURITY) and Discord sessions, bypasses 2FA by session reuse, alters security settings, and lets attackers transfer game/group ownership and drain Robux.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0851
- **ID:** TL-2026-0851
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning in early 2026, attackers have shifted from stealing individual Roblox players' high-value items ('beaming') to seizing entire revenue-generating games and developer groups. The intrusion begins with social engineering on Discord: an actor posing as a recruiter (e.g., Discord handle 'jivedevs') offers a developer a project-manager role at a real-sounding studio (impersonating 'Cheesy Studios' / the Matziaris family's CheesyStudiosOfficial group) to lend credibility, then asks the target to install a Python package named 'robase', described as a 'database tool' or part of the studio's project tooling. In other observed cases the payload is disguised as a 'Python launcher' or a 'roboat plugin'.

Upon execution the package functions as an infostealer focused on session-token theft rather than password theft. It reads authenticated browser sessions and cookies (the campaign specifically abuses the Roblox '.ROBLOSECURITY' session cookie and the Discord token), exfiltrating them to attacker infrastructure. Because the stolen artifacts are already-authenticated sessions, the attacker bypasses two-factor authentication entirely — victims report being logged out of Roblox on both PC and phone, their Discord account compromised, and their 2-step verification and passkey changed without consent. Reported persistence and execution artifacts on at least one victim host include Windows Task Scheduler entries invoking 'applicationbackup_.vbs' which in turn launches 'rEgX.cmd'; endpoint products flagged components as 'BAT/Obfuscated.AW' and 'VBS/Pterodo.AOV'. Targeted browsers include Opera (and, in the broader family of Roblox PyPI stealers, Chrome, Edge, Chromium and Firefox via the 'browser_cookie3' technique that parses '.ROBLOSECURITY=' values for exfiltration to Discord webhooks).

With control of the developer's account, attackers transfer group ownership to an attacker-controlled Roblox account (e.g., '@zetuisgod', user ID 715202, alias 'blockbound_rejection'), move the victim's flagship games into a copycat group ('Official Cheesy Studios', group ID 14957066), drain the group's Robux balance, and ban or remove the original owners. Confirmed victims include the Matziaris brothers' CheesyStudiosOfficial group (ID 7408043, 12,300+ members) whose games 'Backrooms: The Shadow Network' (20,000+ likes) and 'Chrono Battlegrounds Unlimited' (78,300+ visits) were hijacked on 4 April 2026; developer Mohamed Kaparoza (the robase-named case); and 15-year-old developer Jovan Rai, whose game 'Overcoding Overseers' generated ~10,000 Robux/day with ~1,100 concurrent users. Roblox initially declined to restore games until 404 Media made inquiries, then stated it was 'troubled' and restored at least one game, while noting that 'no security measure can completely eliminate the risk of account theft when users are persuaded to run malicious software.'

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal
- T1657 Financial Theft

## Sources

- [Roblox game takeover malware attacks](https://www.helpnetsecurity.com/2026/06/18/roblox-game-takeover-malware-attacks/)
- [Hackers Are Hijacking Entire Roblox Games Now](https://www.404media.co/hackers-are-hijacking-entire-roblox-games-now/)
- [Roblox developers are losing entire games to malware attacks](https://www.malwarebytes.com/blog/scams/2026/06/roblox-developers-are-losing-entire-games-to-malware-attacks)
- [Group Hacked via Malware, CheesyStudiosOfficial (ID: 7408043), Ownership Stolen, Games Transferred, Robux Stolen](https://devforum.roblox.com/t/group-hacked-via-malware-cheesystudiosofficial-id-7408043-ownership-stolen-games-transferred-robux-stolen/4564816)
- [Snyk Labs: PyPI malware that steals Discord and Roblox credential and payment info](https://labs.snyk.io/resources/pypi-malware-discord-roblox-credential-payment-info/)
- [Imperva: Malicious Actors Use Infected PyPI Packages to Target Roblox Cheaters](https://www.imperva.com/blog/trouble-in-da-hood-malicious-actors-use-infected-pypi-packages-to-target-roblox-cheaters/)
- [Sonatype: Malicious Roblox Cookie and Discord Token Stealers Hit PyPI Repository](https://www.sonatype.com/blog/malicious-roblox-cookie-and-discord-token-stealers-hit-pypi-repository)
- [Dark Reading: Whack-a-Mole — Malicious PyPI Packages Target Discord, Roblox](https://www.darkreading.com/application-security/whack-a-mole-malicious-pypi-packages-target-discord-roblox)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0851