For the creators building digital worlds on Roblox, the threat landscape has shifted from simple theft of in-game assets to the complete hijacking of entire studios. While account compromise to steal valuable items has long been a known risk, a new wave of attacks is now seizing ownership of full games and creative ecosystems. This evolution means that the livelihoods of independent developers are under direct threat, as malicious actors are not just stealing currency but rewriting the provenance of popular titles.
From stolen items to stolen studios
Multiple developers have reported to 404 Media that their work has been taken over without their consent. In several documented cases, the platform’s support team failed to assist in recovering the assets until this publication intervened on the developers’ behalf.
Ioannis Matziaris described how his two sons, who had spent five years crafting a game titled “The Shadow Network” with over 12,000 members, fell victim to a sophisticated social engineering attack. In April, one of the sons was approached with a job offer that required him to execute a specific file. The file contained malware designed to grant attackers control.
“Within hours, they had taken ownership of our entire Roblox group, transferred our main game to a new group they created, and stolen our Robux,” Matziaris said.
The family’s attempts to resolve the issue through standard channels yielded no results. They contacted Roblox support and filed a DMCA takedown request, receiving no response. Matziaris distinguished this incident from traditional “beaming” hacks, noting instead an organised operation that steals games, republishes them under new identities, and recruits unsuspecting developers to build upon stolen intellectual property.
The stakes for independent creators
Roblox functions as a robust business platform where virtually anyone can develop games. Titles like “Grow a Garden” have achieved massive viral success, operating as substantial video games in their own right. Developers monetise these creations through in-game transactions, with some independent studios generating millions of dollars annually.
The motivation for the hijackers remains partially unclear, though they may simply be stealing currency or attempting to monetise the stolen popularity. However, the platform’s initial response to Matziaris was dismissive. Roblox stated that there was “no indication that group ownership was transferred due to your account being compromised,” effectively denying the family’s claim over their own creation.
Following media coverage, the company adjusted its position. A statement from Roblox expressed concern over the specific incident and confirmed they had restored the game to its rightful owner. The company highlighted several security measures, including “Enhanced Protection,” a professional-grade security layer designed to stop authentication attacks like phishing and credential stuffing. They also noted that “Account Session Protection” is enabled by default to bind web sessions to specific devices.
Unfortunately none of these methods can completely eliminate the risk of account theft, particularly when bad actors convince users to run malicious software on their own devices or execute untrusted code. We continue to work on new ways to prevent these occurrences and actively encourage users to follow security best practices, including not clicking on links or downloading anything from unknown senders.
More victims, more delays
Matziaris’s family is not alone in facing this crisis. Mohamed Kaparoza reported being targeted via Discord after individuals claiming to be recruiters contacted him for a project manager role. The attackers requested the installation of a Python package named “robase,” which they claimed was part of their database tools.
Kaparoza confirmed that shortly after installing the package, he was logged out of his Roblox account on both PC and mobile devices. Simultaneously, his Discord account was compromised. His 2-step verification and passkeys were altered without permission, and his game and group were transferred to another user. He received no notifications regarding logins from new locations before the theft occurred. To date, Roblox has not returned his game.
Jovan Rai, a 15-year-old Canadian developer, faced a similar scenario. The attackers posed as representatives from Cheesy Studios, working on “The Shadow Network”-the very game owned by the Matziaris brothers. They asked Rai to run a file, resulting in the theft of his game, “Overcoding Overseers.”
Rai described the game as his sole source of income, generating approximately 10,000 Robux daily and supporting 1,100 concurrent users. He noted that he had been battling Roblox support for over 30 days to regain ownership. The game was only restored after 404 Media contacted the company for comment. When informed of Kaparoza and Rai’s cases, Roblox reiterated that their support team investigates all claims and restores ownership if they can validate it.
Key takeaways
- Roblox account compromises are evolving from simple currency theft to the hijacking of entire game studios and intellectual property.
- Attackers are using social engineering to trick developers into running malicious software, often under the guise of legitimate job offers.
- While Roblox has enhanced security tools like Enhanced Protection, they cannot fully mitigate risks when users voluntarily execute untrusted code.
- Recovering stolen assets can be a prolonged process, with developers often requiring external media intervention to prompt a response from platform support.
