Roblox Phishing Scam Targets Children to Steal Virtual Currency and Credentials
A recent investigation exposes a sophisticated scam targeting children playing Roblox, utilizing dark web phishing kits to steal login credentials and virtual currency via fake links.
A new investigation published by the British newspaper The Guardian has revealed a widespread phishing scam targeting children playing the popular online game Roblox, aiming to steal their login credentials and accumulated virtual currency. Young players are falling into traps after being promised free Robux in exchange for clicking external links, typically promoted through YouTube, TikTok, and Discord.
The Mechanics of the Phishing Attack
Cybercriminals utilize ready-made scam kits purchased on the dark web to build fake login pages that are visually identical to the legitimate Roblox website. Gerald Kasulis, vice president of information security at NordVPN, explained the mechanism to The Guardian. The child enters their credentials on a malicious page, which then immediately redirects them to the official, legitimate Roblox site so they ultimately reach where they intended to go.
The child will enter their details, and the fake site will actually redirect them to a legitimate Roblox page, meaning the child ultimately gets to where they wanted to go.
However, by that point, the attackers have already captured the necessary details to hijack the account. Cybersecurity researchers discovered approximately 200 web addresses selling these fraudulent login templates and operational tools within a single seven-day period.
False Promises and Platform Exploitation
The fraudulent links are frequently planted within comments on YouTube and TikTok videos, or distributed across gamer chat applications like Discord. To manipulate victims into acting hastily without considering the security implications, scammers incorporate artificial urgency, claiming the offers are valid for only a few hours. The deceptive URLs often incorporate recognizable terms such as Roblox-verify to manufacture a false sense of authenticity.
Once victims land on the malicious pages, they are prompted to input usernames, passwords, and occasionally two-factor authentication codes. Once obtained, cybercriminals can liquidate the accounts or transfer virtual currency to wallets under their control.
Recovering Stolen Assets
Experts advise parents to encourage children to access the game strictly through official applications or verified websites. Marius Briedis, another security expert at NordVPN, emphasized that authentication and backup codes must be treated with the same confidentiality as passwords.
If virtual assets or accounts are compromised, the chances of recovering them remain exceptionally slim. Roblox stated in response to the investigation that it holds no obligation to assist individuals whose accounts have been hacked unless strictly mandated by law, and cannot guarantee the restoration of lost virtual items.
