Threat reportMalwareTL-2026-1846
Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)
Fake Roblox Xeno Script Launcher Pushes Multi-Stage (TL-2026-1846), also tracked as Powercat, is a high-severity malware campaign, first published 2026-08-03. It has no confirmed attribution, affects Roblox Corporation Roblox Player, maps to 24 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-1846
- Threat ID
- TL-2026-1846
- Also known as
- Powercat, Xeno Executor Malware
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- gaming, entertainment, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Fake Roblox Xeno Script Launcher Pushes Multi-Stage
Malware and tooling: PowerCat, Xeno Stealer/RAT
How Fake Roblox Xeno Script Launcher Pushes Multi-Stage works
A malware campaign targeting the Roblox playerbase distributes a sophisticated multi-stage Java-based infostealer and RAT disguised as the 'Xeno Executor' cheat utility. Delivered via gaming forums, Discord servers, and compromised accounts, the payload chain uses a trojanized xeno.exe first-stage loader, an Allatori-obfuscated Java second-stage (decompiler.exe), and a final third-stage JAR that steals browser credentials, Discord/Roblox/Minecraft tokens, Microsoft Store payment info, cryptocurrency wallets (with targeted Exodus seed-phrase injection), and enables full remote control including keylogging, desktop streaming, webcam capture, file transfer, and interactive PowerShell shell. Bitdefender links the campaign to the previously tracked 'Powercat' operation with new C2 infrastructure and significantly expanded capabilities.
Since early 2026, a sustained malware campaign branded under the 'Powercat' designation by ThreatLocker has targeted the Roblox gaming community through trojanized versions of the Xeno Executor, a popular third-party script executor. The campaign was significantly updated with new C2 infrastructure and expanded capabilities, as documented by Bitdefender in August 2026.
Distribution and Lure: The attackers distribute password-protected ZIP archives and self-extracting archives via gaming forums, Discord communities, compromised social-media accounts, and pay-to-cheat websites. The lure is advertised as an 'undetected' version of Xeno Executor that bypasses Roblox anti-cheat. The archive recreates the directory structure of a legitimate Xeno installation, includes genuine Lua scripts, and uses plausible filenames to evade suspicion.
Stage 1 - Initial Loader (xeno.exe): The first-stage payload executes from %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe. It checks for a Java Runtime Environment and, if absent, extracts a portable JRE from a bundled instance.exe via a PowerShell command using System.IO.Compression.FileSystem. The loader reads XenoIcon.jpg, a file containing encrypted validation keys for C2 authentication, and launches javaw.exe with decompiler.exe (a disguised JAR) passing the key material as command-line arguments.
Stage 2 - Java Loader (decompiler.exe): The second stage is a JAR file obfuscated with Allatori (commercial obfuscator), masquerading as decompiler.exe. It performs extensive anti-analysis checks before contacting the C2: debugger detection (checks runtime args for -xdebug, suspend=, jdwp, and stack traces for IDE artifacts), sandbox detection (disk partition size < 20 GB, known MAC addresses for emulated adapters, WMI/registry VM artifacts, running analysis tool processes). It sends a registration POST to solthere.net/justacoolkat10 with collected flags, then validates keys via AES-encrypted POST to solthere.net/api/v1/redeem. The server responds with a JAR payload loaded via loadClass() and invoked reflectively, which downloads the final stage to %LOCALAPPDATA%\Microsoft\GameDVR.
Stage 3 - Java Stealer and RAT: The final payload is a comprehensive Java application masquerading as Windows DLLs (e.g., mscorlib.dll, System.Net.Http.dll, libcef.dll) in the GameDVR directory. It attempts privilege escalation via CMSTP (Microsoft Connection Manager) and establishes persistence via a Registry Run key named 'Display Calibration' with enabled StartupApproved flag. C2 communication uses a dynamically generated WebSocket address: the SHA-256 hash of 'print' (minus the last character) plus '.xyz', producing ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz with NATO-phonetic subdomains per session. The server can push updated JAR files or encrypted task JSON supporting 20+ command types including file operations, PowerShell execution, interactive shell, keylogging (via JNA/User32), screenshot capture, desktop streaming at 500ms intervals, and webcam capture via DirectShow COM interfaces.
Data Theft Capabilities: The malware steals browser cookies and stored data from Chrome, Edge, Brave, Opera, Opera GX, and Vivaldi via DPAPI decryption. It extracts Discord tokens from browser SQLite databases and via the Discord API (retrieving MFA status, payment methods). Roblox cookies and Minecraft account data from multiple launchers (Feather, Lunar, Meteor, Modrinth, Prism, official) are also stolen. A dedicated Exodus wallet attack targets version 26.1.5 by injecting JavaScript into app.asar to intercept seed phrases and wallet buffers, logging them to a file parsed by a background thread. Additional wallets (Atomic, Cake Wallet, SafePal, TronWallet, Monero Wallet) are identified and targeted. Microsoft Store .tbres token files are parsed for stored payment info. The malware also maps installed software including Steam, Epic Games, Battle.net, VPNs, and messaging apps.
Surveillance and Remote Access: The RAT provides keylogging and mouse activity logging via JNA/User32 Windows API hooks, on-demand screenshot capture, continuous desktop streaming (captures every 500ms), webcam capture via DirectShow COM objects, file upload/download/rename, PowerShell command execution with Base64-encoded commands, and an interactive remote shell with I/O redirected through Java to the C2 WebSocket. Geolocation is performed via ipapi.co and ipwho.is to generate a unique victim identifier combined with hardware profile.
Anti-Forensics and Evasion: The malware uses Allatori obfuscation on Stage 2, terminates competing game processes (RobloxPlayerBeta.exe, eurotrucks2.exe, mylovelyexe.exe) via TerminateProcess, performs self-deletion of the downloader after execution, adds Microsoft Defender exclusions for its components, uses only legitimate LOLBins (PowerShell, CMSTP) for staging and escalation, and masquerades payload files with Windows DLL names. The dynamically generated C2 domain via SHA-256 hash makes static blocking difficult.
Attribution: No specific threat actor has been attributed. ThreatLocker first documented the campaign as 'Powercat' in February 2026. Bitdefender's August 2026 analysis identifies the same campaign with new C2 infrastructure and significantly expanded capabilities, indicating active development. The campaign poses particular concern for child safety given the Roblox target demographic, with webcam access and age classification capability enabling potential blackmail or coercion.
MITRE ATT&CK techniques used in TL-2026-1846
Collection
T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture
Exfiltration
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel
stealth
T1218 System Binary Proxy Execution
Initial Access
defense-impairment
Affected products and versions in Fake Roblox Xeno Script Launcher Pushes Multi-Stage
- Roblox Corporation — Roblox Player
Vulnerable versions: All versions - Mojang — Minecraft (all launchers)
Vulnerable versions: Official Launcher; Feather; Lunar Client; Meteor; Modrinth; Prism Launcher; Hypixel - Discord — Discord Client
Vulnerable versions: All versions - Microsoft — Microsoft Store
Vulnerable versions: All versions - Exodus — Exodus Wallet
Vulnerable versions: 26.1.5 - Google — Chrome
Vulnerable versions: All versions - Microsoft — Edge
Vulnerable versions: All versions - Mozilla — Firefox
Vulnerable versions: All versions - Brave Software — Brave
Vulnerable versions: All versions - Opera Software — Opera / Opera GX
Vulnerable versions: All versions
Remediation for Fake Roblox Xeno Script Launcher Pushes Multi-Stage
Immediate actions
- Block C2 domains (powercat.dog, ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz, solthere.net) and IP 79.110.49.15 at network perimeter
- Remove Registry Run key 'Display Calibration' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Delete %LOCALAPPDATA%\Xeno\ and %LOCALAPPDATA%\Microsoft\GameDVR\ directories
- Reset all browser sessions and invalidate stored session cookies
- Rotate Discord, Roblox, and Minecraft account credentials from a clean device
- Transfer cryptocurrency from compromised wallets to new addresses
Workarounds
- Block PowerShell execution via Software Restriction Policies for non-admin users
- Disable CMSTP (Microsoft Connection Manager) if not required in the environment
- Restrict Java execution to signed applications only via deployment.properties
Longer-term hardening
- Deploy EDR with behavioral detection for Java process chains launched from non-standard paths
- Monitor for WebSocket connections to dynamically generated .xyz domains
- Implement application whitelisting to block unsigned executables in %APPDATA% paths
- Deploy network detection for POST requests to /api/v1/redeem and /justacoolkat10 endpoints
- Educate gaming communities on third-party cheat and utility risks
Timeline of Fake Roblox Xeno Script Launcher Pushes Multi-Stage
- Powercat malware campaign first observed targeting Roblox players via fake Xeno Executor downloads; activity detected since start of 2026
- ThreatLocker Threat Intelligence analysts begin tracking the campaign; identifies multi-stage Java infostealer targeting Discord, Roblox, Minecraft, and cryptocurrency wallets
- ThreatLocker documents the campaign as 'Powercat' — three-stage infection chain using 3k3uklt.exe first-stage, jd-gui.jar Java loader, and DLL-masquerading final payload in GameDVR directory; C2 via powercat.dog
- Campaign activity rises sharply in second half of March; Microsoft Defender publishes analysis of trojanized gaming utilities with C2 IP 79.110.49.15 and world.vbs persistence script
- ThreatLocker publishes full Powercat campaign analysis detailing fake game cheat delivery, wallet-specific Exodus attack (v26.1.5 seed phrase injection), and surveillance capabilities
- Splunk Threat Research Team publishes analysis of Salat Stealer campaign distributing malware via Xeno Executor bundles from xenoexecutor.in; additional .NET-based variants identified using Telegram Bot API for C2
- Bitdefender publishes deep technical analysis of the Powercat campaign update; documents new C2 infrastructure (solthere.net, dynamic SHA-256 domain generation), Allatori obfuscation, expanded WebSocket-based C2 with 20+ command types, and enhanced anti-analysis capabilities
- BleepingComputer publishes public awareness article; campaign remains active with sustained infection rates; threat still ongoing as of report date
Sources cited for Fake Roblox Xeno Script Launcher Pushes Multi-Stage
- Fake Roblox Xeno script launcher pushes infostealer, RAT malware
- Fake Xeno Roblox Discord Executor — Bitdefender Labs
- Powercat Malware Campaign: Fake Game Cheats Deliver Infostealer Targeting Discord, Roblox, and Crypto Wallets
- Microsoft Defender Uncovers Trojanized Gaming Utility Campaign
- Bundled to Steal: The Salat Stealer Campaign — Splunk Threat Research
- Is Xeno Executor Safe? — Gridinsoft Analysis
Detection coverage for TL-2026-1846
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1846 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.