Fake Roblox Cheats, npm RAT Clusters, and DarkSword Panels: Defending Against the Latest Malware Distribution Campaigns

The latest Security Affairs malware newsletter (Round 109) highlights three campaigns that should be on every SOC's radar this week: a fake "Xeno" Roblox cheat distributing a Java-based information stealer through Discord and gaming forums, a distributed cluster of malicious npm packages delivering a cross-platform RAT with targeting focused on Alibaba's ecosystem, and an infrastructure analysis of the DarkSword malware operation that unraveled six distinct panels spanning two codebases from a single body hash pivot.

What ties these three stories together is a common theme defenders cannot ignore: adversaries are industrializing malware distribution through trusted channels — gaming communities, developer package registries, and sprawling commodity C2 infrastructure. The victims are not just individual gamers. Developer workstations with npm access hold CI/CD credentials, cloud keys, and source code. A single compromised build engineer can become a supply-chain incident affecting thousands of downstream consumers.

This post breaks down each campaign from a defender's perspective and provides detection content you can deploy today.

Technical Analysis

1. Fake Xeno Roblox Cheats Deliver Java Stealer via Discord and Forums

Threat actors are distributing a Java-based information stealer masquerading as "Xeno," a purported Roblox cheat/executor. Distribution relies on Discord servers and gaming forums — channels where the target demographic (predominantly younger users) is conditioned to disable antivirus, run executables with elevated privileges, and bypass SmartScreen warnings to get cheats working.

Attack chain (defender's view):

1. Victim is lured via Discord invite, forum post, or YouTube video promoting the "Xeno" cheat.
2. Download is typically a ZIP archive containing a Java archive (.jar) or a loader that stages the JAR, sometimes bundled with a JRE so no system Java install is required.
3. Execution occurs via java.exe/javaw.exe or a bundled runtime, with command lines frequently referencing temp or user-profile directories.
4. The stealer harvests browser credentials, cookies, Discord tokens (from Local Storage leveldb files), session tokens, and cryptocurrency wallet data, then exfiltrates — commonly back to Discord webhooks or Telegram bot APIs, which blend into legitimate traffic.

Why this matters to enterprises: These stealers do not stay on home machines. BYOD endpoints, staff with gaming rigs on home networks doing remote work, and corporate credentials cached in personal browsers all bleed into enterprise risk. Discord token theft in particular enables account takeover used for further social engineering against colleagues.

2. Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba

Researchers identified a coordinated cluster of malicious packages published to the npm registry that deploy a cross-platform remote access trojan. The campaign's infrastructure and targeting logic indicate interest in Alibaba's ecosystem — consistent with broader trends of supply-chain operations aimed at Chinese cloud and e-commerce platforms, though the packages themselves will infect any developer who installs them globally.

Attack chain (defender's view):

1. Malicious packages are published to npm, often typosquatting popular libraries or posing as utilities.
2. Execution is triggered by install lifecycle scripts — preinstall, install, or postinstall hooks in package.json — meaning the payload runs the moment npm install executes, before any code is imported.
3. The dropper is cross-platform: JavaScript logic detects the OS (Windows, macOS, Linux) and stages the appropriate RAT binary or script.
4. The RAT establishes persistence and beacons to C2, giving operators remote shell access to developer machines — and by extension, SSH keys, cloud credentials in ~/.aws, ~/.config, environment variables, and CI tokens.

Exploitation status: These packages were live in the public registry — this is active, in-the-wild distribution, not theoretical. Any organization with Node.js developers or CI pipelines that run npm install against the public registry is in scope.

3. DarkSword's Panel Sprawl: One Body Hash Unravels a Six-Panel, Two-Codebase Cluster

The third piece is an infrastructure-attribution case study: analysts pivoted off a single HTTP response body hash shared across DarkSword C2 panels and unraveled a cluster of six active panels built on two distinct codebases, operated as one coordinated cluster.

The defensive lesson here is about threat intelligence tradecraft: commodity malware operators reuse panel kits, favicons, response bodies, and TLS certificate patterns. A single pivot — a body hash, a favicon MurmurHash, a JA3/JA4 fingerprint — can expose an entire operator cluster. For SOC teams, this means:

• Blocking one known C2 IP/domain is insufficient; enumerate the full cluster via shared infrastructure fingerprints.
• Feed body-hash and favicon-hash pivots (e.g., from Shodan/Censys hunting) into blocklists proactively.
• Expect panel reuse across campaigns — today's DarkSword panel hash may resurface under a different malware brand next month.

Detection & Response

The detections below target the two campaigns with concrete endpoint telemetry: the Java stealer (unusual java.exe/javaw.exe execution from user-writable paths and Discord token theft behavior) and the npm RAT (lifecycle-script execution spawning suspicious child processes from node.exe/npm/cmd). The DarkSword guidance above should be operationalized through your threat intel pipeline rather than a single static rule, since panel IPs rotate.

---
title: Java Runtime Executing JAR from User-Writable or Temp Directories
id: 8f2a4c91-3b7d-4e6a-9c15-2d8e6f1a5b30
status: experimental
description: Detects java.exe or javaw.exe launching JAR files from temp, AppData, Downloads, or Public directories — consistent with fake game cheat / Java stealer execution such as the fake Xeno Roblox cheat campaign distributed via Discord and forums.
references:
  - https://attack.mitre.org/techniques/T1059/007/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_cli:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
      - '-jar'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate Java applications launched from user profile paths (rare in enterprise environments)
  - Minecraft or modded game launchers executing from AppData — tune per environment
level: high
---
title: Discord Token Theft via LevelDB Access by Non-Browser Process
id: 3c9e1b74-6d2f-4a8c-b507-9f4a2e8d1c66
status: experimental
description: Detects non-Discord processes accessing Discord Local Storage leveldb files, a hallmark of token-stealing malware including Java stealers distributed through game cheat lures.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\discord\Local Storage\leveldb\'
      - '\discordcanary\Local Storage\leveldb\'
      - '\discordptb\Local Storage\leveldb\'
  filter_legit:
    Image|endswith:
      - '\Discord.exe'
      - '\DiscordCanary.exe'
      - '\DiscordPTB.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Backup or sync tools scanning user profile directories
  - Endpoint security products performing scans — exclude known EDR/AV service processes
level: high
---
title: npm Install Lifecycle Script Spawning Suspicious Child Process
id: 61b4d8a2-5f3c-4e79-82a1-7c5e9b2d4f08
status: experimental
description: Detects node/npm processes spawning shell interpreters, download cradles, or scripting engines consistent with malicious npm package lifecycle scripts (preinstall/postinstall) delivering cross-platform RAT payloads.
references:
  - https://attack.mitre.org/techniques/T1195/002/
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\mshta.exe'
  selection_cli:
    CommandLine|contains:
      - 'http'
      - 'Invoke-'
      - 'IEX'
      - 'DownloadFile'
      - 'DownloadString'
      - 'base64'
      - '-enc'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Legitimate build tooling with install scripts (node-gyp, esbuild, puppeteer downloads) — baseline dev workstations and tune by package name or path
level: medium

// Hunt: npm/node spawning download or script-execution children (malicious package lifecycle scripts)
// plus Java runtime launching JARs from user-writable paths (fake cheat / stealer execution)
let suspiciousJava = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("java.exe", "javaw.exe")
| where ProcessCommandLine has_any ("-jar")
| where ProcessCommandLine has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Downloads\\", "\\Users\\Public\\")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, SHA256;
let suspiciousNpm = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "npm.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "certutil.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("http", "Invoke-", "IEX", "DownloadString", "DownloadFile", "base64", "-enc")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
union suspiciousJava, suspiciousNpm
| order by TimeGenerated desc

-- Hunt for Java stealers and npm-delivered RAT artifacts on Windows endpoints
-- Part 1: java/javaw processes running JARs from user-writable paths
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)javaw?\.exe'
   AND CommandLine =~ '-jar'
   AND CommandLine =~ '(?i)(AppData\\\\(Local|Roaming)|Downloads|Users\\\\Public)')

-- Part 2 (run as separate artifact or UNION): node/npm spawning script/download children
-- SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
-- FROM pslist()
-- WHERE Name =~ '(?i)(powershell|cmd|curl|certutil|mshta|wscript)\.exe'
--   AND CommandLine =~ '(?i)(http|downloadstring|invoke-|base64)'

-- Part 3: recently created .jar files in temp/profile staging locations
-- SELECT FullPath, Size, Mtime, Ctime
-- FROM glob(globs='C:\\Users\\*\\**\\*.jar')
-- WHERE Mtime > now() - 604800
--   AND FullPath =~ '(?i)(Temp|Roaming|Downloads)'

# Audit endpoints for indicators of fake-cheat Java stealers and npm supply-chain payloads
# Run via EDR live response or as a scheduled audit on developer workstations

# 1. Find recently created JAR files in user-writable staging paths
$paths = @("$env:TEMP", "$env:APPDATA", "$env:USERPROFILE\Downloads", "C:\Users\Public")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Filter *.jar -Recurse -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) } |
        Select-Object FullName, CreationTime, Length, @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}}
}

# 2. Check for suspicious npm global/local install artifacts with lifecycle scripts
$npmDirs = @("$env:APPDATA\npm\node_modules", "$env:USERPROFILE\node_modules")
foreach ($d in $npmDirs) {
    if (Test-Path $d) {
        Get-ChildItem -Path $d -Filter package.json -Recurse -Depth 3 -ErrorAction SilentlyContinue | ForEach-Object {
            $pkg = Get-Content $_.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
            if ($pkg.scripts -and ($pkg.scripts.preinstall -or $pkg.scripts.postinstall -or $pkg.scripts.install)) {
                [PSCustomObject]@{ Package=$pkg.name; Version=$pkg.version; Path=$_.FullName; PreInstall=$pkg.scripts.preinstall; PostInstall=$pkg.scripts.postinstall }
            }
        }
    }
}

# 3. Identify persistence in Run keys pointing to user-writable locations
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                  "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match 'AppData|Temp|Public' } |
    Select-Object Name, Value

Remediation

Fake Xeno Roblox cheat / Java stealer:

1. Contain infected endpoints immediately. Java stealers exfiltrate credentials in seconds — assume all browser-stored credentials, Discord tokens, and session cookies on an affected machine are compromised. Revoke active sessions, force credential resets for any account that had cached credentials, and invalidate Discord tokens (password reset invalidates tokens automatically).
2. Block the lure infrastructure. Restrict Discord webhook domains (discord.com/api/webhooks/) at the proxy for endpoints with no business need — webhook exfiltration is the dominant C2 channel for this stealer class. Alert on, don't just block, to surface infections.
3. Application control. Enforce WDAC/AppLocker policies preventing java.exe/javaw.exe from executing JARs outside approved application paths. Few enterprise use cases require user-profile Java execution.
4. User awareness targeting the actual lure. Gaming cheat lures reach corporate risk through BYOD and remote workers. Include this campaign in awareness communications — explicitly: "free Roblox cheats = credential theft."

Malicious npm package cluster / cross-platform RAT:

1. Pin and lock dependencies. Enforce package-lock.json integrity, prohibit npm install of unpinned versions in CI, and enable npm ci with --ignore-scripts where build requirements permit.
2. Disable lifecycle scripts by default in CI/CD. Set ignore-scripts=true in .npmrc for build agents, with an explicit allowlist for packages that legitimately require postinstall (e.g., esbuild, node-gyp).
3. Private registry proxying. Route all npm traffic through an artifact proxy (JFrog Artifactory, Sonatype Nexus, Azure Artifacts upstream) with malware-blocking policies and quarantine of newly published package versions until vetted.
4. Hunt developer machines and build agents now. Run the KQL and PowerShell content above against all systems with Node.js toolchains. Any hit means credential rotation: npm tokens, SSH keys, cloud CLI credentials, and CI secrets reachable from that host.
5. Check CISA and registry advisories. Monitor the npm security advisories and GitHub Advisory Database for the disclosed package names from this cluster and audit lockfiles for their presence — past and present.

DarkSword panel cluster:

1. Ingest the full cluster, not single indicators. Add all six panel IPs/domains and both codebase fingerprints to blocklists and retro-hunt proxy/firewall logs for historical connections.
2. Operationalize hash-based pivots. Task your threat intel function with tracking the panel body hash/favicon hash via Shodan/Censys — panel operators routinely redeploy on new infrastructure with identical fingerprints.
3. Egress filtering. DarkSword-class commodity RATs depend on outbound C2. Enforce default-deny egress with category-based filtering; alert on connections to newly registered or uncategorized domains.

No CVEs are associated with these campaigns — the remediation lever here is behavioral detection, egress control, and hardening of the software supply chain, not patching.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub