Xeno Executor
Malware Warning, Status and Facts

Overview

Xeno is a free external Windows executor. ScriptBlox currently lists it as Detected with a 40% sUNC score as of 2026. The WEAO editorial notes that Xeno lacks exploit functions many scripts use because it is an external executor that does not inject internally, and that it is often the first exploit to update under normal Roblox update conditions.

Separately, a malware campaign has been running since the start of 2026 that distributes fake Xeno installers through gaming forums, Discord communities and compromised accounts. Bitdefender documented this campaign in detail. RageInject does not host the Xeno binary and cannot verify what any given build contains.

Observable Facts

Platform	Windows (external executor)
Price	Free
Status	Detected per ScriptBlox
sUNC	40% on ScriptBlox
Source	scriptblox.com/executor/xeno

Malware Warning

Bitdefender researchers documented a campaign that distributes fake Xeno Executor installers. The attackers promote the malware as an "undetected" version of Xeno through gaming forums, Discord communities and compromised accounts. Victims download ZIP archives that recreate the directory structure of a legitimate Xeno installation, include some genuine Lua scripts and use plausible filenames.

Once the victim launches xeno.exe, it runs a first-stage loader. The payload checks for a Java Runtime Environment, extracts one if necessary, and launches an obfuscated Java payload disguised as decompiler.exe. The final payload is a Java-based RAT and information stealer that steals browser data from Chrome, Edge, Brave, Opera and Vivaldi, targets Discord and Roblox tokens, Minecraft data, Microsoft Store tokens and cryptocurrency wallets, and provides keylogging, webcam access, desktop streaming and full remote control.

Bitdefender believes the campaign is related to the previously documented Powercat malware family. The activity has been observed since the beginning of 2026 and rose sharply in March before stabilizing.

What Xeno Is

Xeno is a script executor. A script executor is third-party software designed to execute Lua or Luau scripts with the Roblox client. Roblox itself uses Luau, a scripting language derived from Lua, for developing experiences. Script executors are commonly associated with modifying gameplay, automation and exploits.

Xeno is an external executor, meaning it does not inject internally. This limits the functions it can support and reduces its sUNC score compared to internal executors.

Ban Risk

Roblox prohibits cheating and exploiting. The company states that exploiting or cheating violates its Terms of Use and can result in account deletion. Xeno is currently marked Detected, meaning it has been flagged by Roblox's anti-cheat system and carries elevated ban risk.

File Integrity

# Windows — compare against the vendor's published hash
certutil -hashfile Xeno.zip SHA256

# macOS or Linux
shasum -a 256 Xeno.zip

Related Executors

Frequently Asked Questions