Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign) — Threadlinqs Intelligence
As of 2026-08-03, Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1846 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A malware campaign targeting the Roblox playerbase distributes a sophisticated multi-stage Java-based infostealer and RAT disguised as the 'Xeno Executor' cheat utility. Delivered via gaming forums,
Since early 2026, a sustained malware campaign branded under the 'Powercat' designation by ThreatLocker has targeted the Roblox gaming community through trojanized versions of the Xeno Executor, a popular third-party script executor. The campaign was significantly updated with new C2 infrastructure and expanded capabilities, as documented by Bitdefender in August 2026.
Distribution and Lure: The attackers distribute password-protected ZIP archives and self-extracting archives via gaming forums, Discord communities, compromised social-media accounts, and pay-to-cheat websites. The lure is advertised as an 'undetected' version of Xeno Executor that bypasses Roblox anti-cheat. The archive recreates the directory structure of a legitimate Xeno installation, includes genuine Lua scripts, and uses plausible filenames to evade suspicion.
Stage 1 - Initial Loader (xeno.exe): The first-stage payload executes from %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe. It checks for a Java Runtime Environment and, if absent, extracts a portable JRE from a bundled instance.exe via a PowerShell command using System.IO.Compression.FileSystem. The loader reads XenoIcon.jpg, a file containing encrypted validation keys for C2 authentication, and launches javaw.exe with decompiler.exe (a disguised JAR) passing the key material as command-line arguments.
Stage 2 - Java Loader (decompiler.exe): The second stage is a JAR file obfuscated with Allatori (commercial obfuscator), masquerading as decompiler.exe. It performs extensive anti-analysis checks before contacting the C2: debugger detection (checks runtime args for -xdebug, suspend=, jdwp, and stack traces for IDE artifacts), sandbox detection (disk partition size < 20 GB, known MAC addresses for emulated adapters, WMI/registry VM artifacts, running analysis tool processes). It sends a registration POST to solthere.net/justacoolkat10 with collected flags, then validates keys via AES-encrypted POST to solthere.net/api/v1/redeem. The server responds with a JAR payload loaded via loadClass() and invoked reflectively, which downloads the final stage to %LOCALAPPDATA%\Microsoft\GameDVR.
Stage 3 - Java Stealer and RAT: The final payload is a comprehensive Java application masquerading as Windows DLLs (e.g., mscorlib.dll, System.Net.Http.dll, libcef.dll) in the GameDVR directory. It attempts privilege escalation via CMSTP (Microsoft Connection Manager) and establishes persistence via a Registry Run key named 'Display Calibration' with enabled StartupApproved flag. C2 communication uses a dynamically generated WebSocket address: the SHA-256 hash of 'print' (minus the last character) plus '.xyz', producing ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz with NATO-phonetic subdomains per session. The server can push updated JAR files or encrypted task JSON supporting 20+ command types including file operations, PowerShell execution, interactive shell, keylogging (via JNA/User32), screenshot capture, desktop streaming at 500ms intervals, and webcam capture via DirectShow COM interfaces.
Data Theft Capabilities: The malware steals browser cookies and stored data from Chrome, Edge, Brave, Opera, Opera GX, and Vivaldi via DPAPI decryption. It extracts Discord tokens from browser SQLite databases and via the Discord API (retrieving MFA status, payment methods). Roblox cookies and Minecraft account data from multiple launchers (Feather, Lunar, Meteor, Modrinth, Prism, official) are also stolen. A dedicated Exodus wallet attack targets version 26.1.5 by injecting JavaScript into app.asar to intercept seed phrases and wallet buffers, logging them to a file parsed by a background thread. Additional wallets (Atomic, Cake Wallet, SafePal, TronWallet, Monero Wallet) are identified and targeted. Microsoft Store .tbres token files are parsed for stored payment info. The malware also maps installed software including Steam, Epic Games, Battle.net, VPNs, and messaging apps.
Surveillance and Remote Access
Target sectors: gaming, entertainment, finance
Target regions: Global
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1059, T1547, T1053, T1218, T1027, T1036, T1497, T1685, T1140
