# Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)

> A malware campaign targeting the Roblox playerbase distributes a sophisticated multi-stage Java-based infostealer and RAT disguised as the 'Xeno Executor' cheat utility. Delivered via gaming forums, Discord servers, and compromised accounts, the payload chain uses a trojanized xeno.exe first-stage loader, an Allatori-obfuscated Java second-stage (decompiler.exe), and a final third-stage JAR that steals browser credentials, Discord/Roblox/Minecraft tokens, Microsoft Store payment info, cryptocurrency wallets (with targeted Exodus seed-phrase injection), and enables full remote control including keylogging, desktop streaming, webcam capture, file transfer, and interactive PowerShell shell. Bitdefender links the campaign to the previously tracked 'Powercat' operation with new C2 infrastructure and significantly expanded capabilities.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1846
- **ID:** TL-2026-1846
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since early 2026, a sustained malware campaign branded under the 'Powercat' designation by ThreatLocker has targeted the Roblox gaming community through trojanized versions of the Xeno Executor, a popular third-party script executor. The campaign was significantly updated with new C2 infrastructure and expanded capabilities, as documented by Bitdefender in August 2026.

Distribution and Lure: The attackers distribute password-protected ZIP archives and self-extracting archives via gaming forums, Discord communities, compromised social-media accounts, and pay-to-cheat websites. The lure is advertised as an 'undetected' version of Xeno Executor that bypasses Roblox anti-cheat. The archive recreates the directory structure of a legitimate Xeno installation, includes genuine Lua scripts, and uses plausible filenames to evade suspicion.

Stage 1 - Initial Loader (xeno.exe): The first-stage payload executes from %LOCALAPPDATA%\Xeno\workspace\cache\xeno.exe. It checks for a Java Runtime Environment and, if absent, extracts a portable JRE from a bundled instance.exe via a PowerShell command using System.IO.Compression.FileSystem. The loader reads XenoIcon.jpg, a file containing encrypted validation keys for C2 authentication, and launches javaw.exe with decompiler.exe (a disguised JAR) passing the key material as command-line arguments.

Stage 2 - Java Loader (decompiler.exe): The second stage is a JAR file obfuscated with Allatori (commercial obfuscator), masquerading as decompiler.exe. It performs extensive anti-analysis checks before contacting the C2: debugger detection (checks runtime args for -xdebug, suspend=, jdwp, and stack traces for IDE artifacts), sandbox detection (disk partition size < 20 GB, known MAC addresses for emulated adapters, WMI/registry VM artifacts, running analysis tool processes). It sends a registration POST to solthere.net/justacoolkat10 with collected flags, then validates keys via AES-encrypted POST to solthere.net/api/v1/redeem. The server responds with a JAR payload loaded via loadClass() and invoked reflectively, which downloads the final stage to %LOCALAPPDATA%\Microsoft\GameDVR.

Stage 3 - Java Stealer and RAT: The final payload is a comprehensive Java application masquerading as Windows DLLs (e.g., mscorlib.dll, System.Net.Http.dll, libcef.dll) in the GameDVR directory. It attempts privilege escalation via CMSTP (Microsoft Connection Manager) and establishes persistence via a Registry Run key named 'Display Calibration' with enabled StartupApproved flag. C2 communication uses a dynamically generated WebSocket address: the SHA-256 hash of 'print' (minus the last character) plus '.xyz', producing ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz with NATO-phonetic subdomains per session. The server can push updated JAR files or encrypted task JSON supporting 20+ command types including file operations, PowerShell execution, interactive shell, keylogging (via JNA/User32), screenshot capture, desktop streaming at 500ms intervals, and webcam capture via DirectShow COM interfaces.

Data Theft Capabilities: The malware steals browser cookies and stored data from Chrome, Edge, Brave, Opera, Opera GX, and Vivaldi via DPAPI decryption. It extracts Discord tokens from browser SQLite databases and via the Discord API (retrieving MFA status, payment methods). Roblox cookies and Minecraft account data from multiple launchers (Feather, Lunar, Meteor, Modrinth, Prism, official) are also stolen. A dedicated Exodus wallet attack targets version 26.1.5 by injecting JavaScript into app.asar to intercept seed phrases and wallet buffers, logging them to a file parsed by a background thread. Additional wallets (Atomic, Cake Wallet, SafePal, TronWallet, Monero Wallet) are identified and targeted. Microsoft Store .tbres token files are parsed for stored payment info. The malware also maps installed software including Steam, Epic Games, Battle.net, VPNs, and messaging apps.

Surveillance and Remote Access: The RAT provides keylogging and mouse activity logging via JNA/User32 Windows API hooks, on-demand screenshot capture, continuous desktop streaming (captures every 500ms), webcam capture via DirectShow COM objects, file upload/download/rename, PowerShell command execution with Base64-encoded commands, and an interactive remote shell with I/O redirected through Java to the C2 WebSocket. Geolocation is performed via ipapi.co and ipwho.is to generate a unique victim identifier combined with hardware profile.

Anti-Forensics and Evasion: The malware uses Allatori obfuscation on Stage 2, terminates competing game processes (RobloxPlayerBeta.exe, eurotrucks2.exe, mylovelyexe.exe) via TerminateProcess, performs self-deletion of the downloader after execution, adds Microsoft Defender exclusions for its components, uses only legitimate LOLBins (PowerShell, CMSTP) for staging and escalation, and masquerades payload files with Windows DLL names. The dynamically generated C2 domain via SHA-256 hash makes static blocking difficult.

Attribution: No specific threat actor has been attributed. ThreatLocker first documented the campaign as 'Powercat' in February 2026. Bitdefender's August 2026 analysis identifies the same campaign with new C2 infrastructure and significantly expanded capabilities, indicating active development. The campaign poses particular concern for child safety given the Roblox target demographic, with webcam access and age classification capability enabling potential blackmail or coercion.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1082 System Information Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1095 Non-Application Layer Protocol
- T1020 Automated Exfiltration

## Sources

- [Fake Roblox Xeno script launcher pushes infostealer, RAT malware](https://www.bleepingcomputer.com/news/security/fake-roblox-xeno-script-launcher-pushes-infostealer-rat-malware/)
- [Fake Xeno Roblox Discord Executor — Bitdefender Labs](https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor)
- [Powercat Malware Campaign: Fake Game Cheats Deliver Infostealer Targeting Discord, Roblox, and Crypto Wallets](https://www.threatlocker.com/blog/powercat-malware-campaign-fake-game-cheats-deliver-infostealer-targeting-discord-roblox-and-crypto-wallets)
- [Microsoft Defender Uncovers Trojanized Gaming Utility Campaign](https://cybersecuritynews.com/microsoft-defender-uncovers-trojanized-gaming-utility-campaign/)
- [Bundled to Steal: The Salat Stealer Campaign — Splunk Threat Research](https://www.splunk.com/en_us/blog/security/salat-stealer-campaign.html)
- [Is Xeno Executor Safe? — Gridinsoft Analysis](https://blog.gridinsoft.com/is-xeno-executor-safe/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1846