Fraudulent Xeno Executor installers are infecting Roblox players with malware that steals data and grants remote access to attackers. The malicious software poses as a legitimate script launcher.
Cybersecurity researchers have identified counterfeit versions of Xeno Executor, a popular Roblox script launcher, distributing infostealer and remote access trojan (RAT) malware to unsuspecting players.
The fake installers appear legitimate, using branding and distribution methods that mirror the genuine tool. Once executed, the malware harvests sensitive information from infected systems and establishes remote access capabilities for attackers.
Roblox players seeking script execution tools are particularly vulnerable, as they often search for third-party launchers to enhance gameplay. Attackers exploit this demand by distributing trojanized versions through unofficial channels.
Security experts advise users to only download software from official sources and verify authenticity before installation. Roblox itself prohibits third-party script executors in its terms of service, and using unauthorized tools risks account compromise alongside malware infection.
Users who have downloaded suspicious Xeno installers should immediately run malware scans and change passwords for accounts accessed on affected systems.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.