With nearly 50m active users, it’s no surprise that cybercriminals continue to target the popular online game Roblox with all manner of scams and attacks.
According to new research from Checkpoint, researchers from Avanan discovered a trojan file hidden inside the legitimate Synapse X scripting tool which is used to inject exploits or cheat codes into Roblox.
Cybercriminals have begun leveraging Synapse X to install a self-executing program on Windows PCs that installs library files into the Windows system folder. This has the potential to break applications, corrupt or remove data or even send information back to the cybercriminals responsible.
Avanan researchers first found the trojan file used in the latest round of Roblox attacks inside a customer’s OneDrive. While the customer could have uploaded it to their cloud storage by mistake, the cloud email and collaboration security company scanned the file and labeled it as malicious.
Putting family and even business PCs at risk
The specific version of Synapse X used in these attacks against Roblox users drops three files on a victim’s system with one of them being a backdoor trojan.
From here, the trojan installs library files (DLL) into the victim’s Windows system folder and this malicious code can be perpetually referenced by Windows and remain running.
In addition to being able to break applications and listen to files, these attacks are particularly concerning due to the fact that Roblox is mainly played by children. As a result, the trojan can easily be installed on a personal computer which may not even have antivirus software installed. However, there’s also a corporate risk, since employees working from home may let their children play Roblox on their business laptops.
After finding this new trojan targeting Roblox users, Avanan reached out to the Roblox Corporation and the two have been communicated via email with plans to connect further via phone regarding the issue.
The Roblox Corporation also reached out to TechRadar Pro with the following statement regarding Avanan's report:
“This report represents a misleading picture of this exploit, which is in Synapse X, not Roblox. Using third party services to circumvent specific systems is also against our Terms of Service. Roblox maintains many systems to keep our users safe and secure, and we prohibit attempts to bypass these systems or otherwise violate our platform requirements.”
In order to protect your devices from these kinds of attacks, Checkpoint recommends that users avoid downloading files from untrusted sites, use malware scanning when accessing cloud storage services like OneDrive and Google Drive and install an antivirus on all of their personal computers.
