With nearly 50m active users, it’s no surprise that cybercriminals continue to target the popular online game Roblox with all manner of scams and attacks.
According to new research from Checkpoint, researchers from Avanan discovered a trojan file hidden inside the legitimate Synapse X scripting tool which is used to inject exploits or cheat codes into Roblox.
Cybercriminals have begun leveraging Synapse X to install a self-executing program on Windows PCs that installs library files into the Windows system folder. This could cause applications to be broken, corrupted or removed data, or even send information back the cybercriminals.
Avanan researchers first found the trojan file used in the latest round of Roblox attacks inside a customer’s OneDrive. While the customer could have uploaded it to their cloud storage by mistake, the cloud email and collaboration security company scanned the file and labeled it as malicious.
Putting family and even business PCs at risk
The specific version of Synapse X used in these attacks against Roblox users drops three files on a victim’s system with one of them being a backdoor trojan.
From here, the trojan installs library files (DLL) into the victim’s Windows system folder and this malicious code can be perpetually referenced by Windows and remain running.
In addition to being able to break applications and listen to files, these attacks are particularly concerning due to the fact that Roblox is mainly played by children. As a result, the trojan can easily be installed on a personal computer which may not even have antivirus software installed. However, there’s also a corporate risk, since employees working from home may let their children play Roblox on their business laptops.
After finding this new trojan targeting Roblox users, Avanan reached out to the Roblox Corporation and the two have been communicated via email with plans to connect further via phone regarding the issue.
In order to protect your devices from these kinds of attacks, Checkpoint recommends that users avoid downloading files from untrusted sites, use malware scanning when accessing cloud storage services like OneDrive and Google Drive and install an antivirus on all of their personal computers.
After getting his start at ITProPortal while living in South Korea, Anthony now writes about cybersecurity, web hosting, cloud services, VPNs and software for TechRadar Pro. He writes the news and also reviews, uploads, and tests many VPNs from Houston, Texas. Anthony recently took a closer look at standing desks and office chairs, as well as other essentials for working from home. Anthony can be found tinkering on PCs and gaming consoles, connecting cables, and updating his smart home.