Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information.

Xeno Executor is a popular Roblox utility for running scripts that players can use to automate actions or run custom code on the platform, including cheats.

The tool isn’t an official part of the game, so the Roblox client periodically blocks existing versions, forcing the tool’s creators to release new  versions that run undetected.

Cybersecurity company Bitdefender discovered a campaign targeting Roblox users since the start of the year, rising sharply in March before stabilizing.

The researchers found that the fake Xeno is promoted to Roblox players through gaming forums, Discord communities, or via compromised or impersonated accounts controlled by the threat actors.

The attackers advertise the malware as an “undetected” version of Xeno, luring users looking for a version that wouldn’t be detected by Roblox’s anti-cheat protections.

The victims download ZIP archives containing the fake Xeno installers along with instructions, or self-extracting archives that unpack content automatically.

To make these packages look authentic, the attackers recreate the directory structure of a legitimate Xeno installation, include some genuine Lua scripts, and use plausible filenames.

Once victims launch ‘xeno.exe,’ as instructed, believing it is the legitimate Xeno executable, they actually run the first-stage malware loader.

The payload checks for a Java Runtime Environment, and extracts one if necessary, then reads a local file containing the validation keys for the attackers’ command-and-control (C2) server.

It then launches an obfuscated Java payload disguised as ‘decompiler.exe,’ which performs environment checks, registers the victim, and downloads the final malware payload.

The final payload is a Java-based RAT and information stealer malware that combines credential theft with surveillance and remote administration capabilities.

Its most important capabilities are summarized as follows:

• Steals browser data including cookies and other stored user data from Chrome, Edge, Brave, Opera, and Vivaldi.
• Targets online accounts and payment data, including Discord, Roblox, Minecraft, Microsoft Store tokens, and payment information associated with Discord and Microsoft Store accounts.
• Steals cryptocurrency wallet data, with dedicated functionality targeting Exodus Wallet and support for identifying numerous other cryptocurrency wallets.
• Provides surveillance capabilities, including keylogging, mouse activity logging, screenshot capturing, desktop streaming, and webcam access.
• Enables full remote control, allowing attackers to upload and download files, execute PowerShell commands, and access an interactive remote shell.

Bitdefender believes the campaign is the same as the one ThreatLocker previously documented as “Powercat,” but with significant updates to the malware’s capabilities and a new C2 infrastructure, indicating continuous evolution.

Bitdefender has shared indicators of compromise (IoCs) for the campaign and recommends that Roblox players completely avoid installing third-party tools from obscure sources.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Malwarebytes, one of CNET.com’s Best Antivirus Overall Editors’ Choice award picks, is offering students at US colleges and universities two free years of its Malwarebytes Premium Security software suite through its Student Protection Program. The offer includes coverage for up to three devices.

Malwarebytes built its reputation on malware removal before expanding into a full antivirus suite with phishing and scam protection, ransomware defense and ad blocking. In our 2026 review, CNET’s testing team praised Malwarebytes as “an excellent choice for anyone who wants reliable security software for three or fewer devices,” awarding it our coveted Editors’ Choice badge and tying it with Bitdefender for the Best Antivirus Overall.

A representative for Malwarebytes didn’t immediately respond to a request for comment.

The Student Protection Program is open to students 18 or older enrolled at colleges and universities in the US who can produce a .edu or .college email address. The fine print on Malwarebytes’ site says it’s limiting the availability to the US, but may eventually expand the program globally. Students can check whether their school is eligible by entering their email address at the Malwarebytes website. There’s an option to request early access for schools not on the list or to fall back on a 50% student discount instead.

For students who qualify, the program unlocks the full Premium Security Standard tier. That includes real-time malware and ransomware protection, phishing and scam detection, and ad and tracker blocking. While Malwarebytes recommends a setup of one laptop, one phone and one tablet, students can use the three device slots however they choose. Once the two-year period ends, students can either keep using a limited free version without features such as real-time protection, automatic updates, and scheduled scans, or switch to a Premium subscription, which currently costs $60 per year.

The timing lines up nicely with the back-to-school season. Move-in time at a new institution means connecting unfamiliar devices to unfamiliar networks, downloading course software from links sent via email, and juggling phishing attempts disguised as financial aid notices or campus IT alerts. It can be a bit of an information security minefield, tough to add to the already overwhelming experience of school. Free access to trusted security software can at least take one thing off a student’s already crowded plate.

Antuan Goodwin

Senior Writer, Electrified Cars

Antuan has nearly 20 years of expertise and experience testing hundreds of cars, including electric, hybrid, plug-in hybrid, hydrogen, and traditional combustion vehicles.

See full bio

Advertisement

What just happened? Linux has reached double-digit territory in North America’s desktop usage share, according to StatCounter, but the size of the jump raises as many questions as it answers. The latest data shows Linux at 10.61% in June 2026, up from 3.56% in May, while Windows fell from 64.66% to 57.63% over the same period.

The shift stands out because the change was not gradual but abrupt. Linux’s rise came largely at Windows’ expense, while OS X saw only limited movement over the same period. That makes the month-to-month swing look less like a slow adoption trend and more like a sharp change in the mix of measured traffic.

StatCounter’s figures are based on desktop web usage rather than a count of installed machines, so they reflect browsing behavior rather than a direct census of operating systems. That matters because changes in who is browsing, how they browse, or what software is generating traffic can shift the results without reflecting a corresponding change in real-world desktop usage.

The latest reading is also part of a broader increase in Linux’s share of StatCounter’s North American desktop traffic. The June figure follows the sharp increase recorded in May, pushing Linux into a range that has long been out of reach in these monthly reports.

There is no hard evidence explaining the spike, but the scale of the increase leaves room for several possibilities. One is ordinary user migration, particularly from Windows, since that platform gave up the largest share over the same period. Another is that automated traffic may be playing a role. StatCounter itself flags the possibility that some of the new Linux activity could be bot-related, which would make the jump appear larger than a shift driven entirely by human users.

That possibility is worth keeping in mind because Linux is often used to run automated systems, including workloads that generate web traffic. Even so, the StatCounter reading marks an unusual moment for a platform that has spent years well below mainstream desktop levels in North America.

For now, the numbers support a narrow conclusion: Linux has crossed 10% in StatCounter’s North American desktop web-usage data, and the move appears to have come mostly at Windows’ expense. Whether that reflects a genuine shift in users, a surge in automated traffic, or a temporary distortion in the data remains unclear.

• Advanced Full Fibre Broadband from EE offers download speeds of 2.3Gbps and 8Gbps
• Speeds are potentially 222 times faster than standard superfast fibre
• Initially available in Guildford and Woking, expanding as Openreach rolls out its XGS-PON glass fibre network

Following a successful trial in early 2026, EE has launched its new Advanced Full Fibre Broadband plans, advertising download speeds of 2.3Gbps and 8Gbps. This makes EE the first provider to sell access to the Openreach XGS-PON glass fibre network.

The plans are initially only available in the Guildford and Woking areas, two Surrey towns in the London commuter belt, where the glass fibre network is installed and active.

Sony designs Bravia TVs with premium features and high-quality displays, but many buyers are still unaware of where they are made. Sony uses a global manufacturing network that includes countries such as China, Japan, Malaysia, India, and Mexico. The company also depends on outside suppliers for important components like OLED and QD-OLED panels. Over time, Sony has reduced its own factory operations and started relying more on manufacturing partners, which has changed how and where Bravia TVs are produced today.

Sony Bravia

Sony Bravia became Sony’s main television brand in 2008 and is now sold in many countries worldwide. These TVs are popular for their premium display quality, color accuracy, and smart image-processing features. Sony develops the software, features, and designs for its TVs, while manufacturing partners produce and assemble the products. The company also depends on outside suppliers for important TV components like display panels.

Where Are Sony TVs Manufactured?

Sony Bravia TVs are manufactured across different countries as part of Sony’s global production network. Major manufacturing locations include China, Japan, India, Malaysia, Mexico, Slovakia, and Thailand. China handles a large share of TV assembly and display-related production, while India produces many TVs for regional buyers through Sony’s partnership with Foxconn. Japan and Malaysia still support several electronics manufacturing operations for the company. Different factories are used to serve nearby international markets and reduce supply costs.

Over time, Sony has been able to cut down on the number of factories that it has. This is because it used to manufacture TVs in factories that were in other countries like Brazil, Spain, Vietnam, Mexico, and Slovakia. In 2010, Sony sold the Spain facility, later closed the Brazil factory in 2021, and had previously shut down the Vietnam plant in 2008. It also sold the Mexican and Slovakian plants to Foxconn in its attempt to minimize costs.

Now, Sony emphasizes technology and product development more and relies on other firms in manufacturing. The firm Foxconn is responsible for making Sony TVs that support various markets. Outsourcing production will help Sony cut costs, become more efficient, and manufacture effectively from all corners of the globe.

Who Supplies Sony TV Panels?

Currently, Sony uses TV panels manufactured by other producers rather than creating them through its plants. The OLED panels used by Sony for its products come mostly from LG, while Samsung produces QD-OLED panels. There are a limited number of producers of TV panels; therefore, most TV makers use similar TV panels. Most of Sony’s development efforts focus on software and image processing.

Sony uses its own picture-processing systems and display tuning to improve the quality of Bravia TVs. These technologies help deliver better colors, sharper details, and smoother motion performance. Because of this, Sony delivers excellent image quality in its TVs even when other manufacturers supply the display panels.

TCL’s Role in Sony Bravia TVs

After acquiring the majority stake in Bravia Inc., TCL is a significant player in determining the future of Sony Bravia television sets. However, Sony will continue to use its imaging technologies and displays in order to create the perfect experience of using Bravia televisions. Given that TCL has a wide manufacturing base in China, there is an expectation that Bravia television manufacturing will increasingly shift to China post 2027.

Today, Sony Bravia TVs are produced using parts and factories from different countries across Sony’s global supply chain. Even so, Sony continues to handle the software and image-processing systems that shape the overall viewing experience. For most customers, Sony’s strong reputation for display quality matters more than the exact factory location of the TV.

Security researchers have discovered three attacks that allow malware on already-compromised Windows devices to abuse Google Password Manager’s synced passkeys to take over accounts, bypass user verification, and extract passkey private keys.

Passkeys are a passwordless authentication method that uses cryptographic keys stored on a user’s device to sign in to online accounts.

They are considered safer than passwords because they cannot be guessed, reused, or easily stolen through phishing, while also allowing users to authenticate with a PIN or biometrics, such as a fingerprint or facial recognition.

“Unlike passwords, passkeys can’t be shared, copied, written down, or accidentally given to someone else. This makes them more secure against phishing,” reads Google’s passkey documentation.

However, a new report by Palo Alto Networks’ Unit 42 demonstrates three novel attacks, collectively called “Pass-ta-key,” that target Google Password Manager in Chrome on Windows devices equipped with a Trusted Platform Module (TPM).

All three attacks require malware to already be running on the victim’s computer and do not break the cryptography used by passkeys. Instead, they exploit weaknesses in how Chrome and Google’s cloud authenticator handle device trust, onboarding, recovery, and synced credentials.

The first technique, named Pass-ta-key, allows unprivileged malware to impersonate a trusted device and request a valid authentication response for one of the victim’s passkeys.

The malware abuses Chrome’s TPM-backed device identity key to sign a request sent to Google’s cloud authenticator. This can be done without administrator privileges, user interaction, biometrics, or unlocking the device.

Google’s cloud authenticator then treats the request as coming from the victim’s trusted computer and returns a signed authentication response, known as an assertion, that can be used to log in to the targeted account.

However, the assertion includes a User Verified flag indicating whether biometric or PIN verification occurred. This causes the attack to fail if a service requires and properly validates that user verification was successful.

While the attack failed against GitHub, which properly checked the User Verified flag, Unit 42 said it successfully tested the attack against eBay. Although eBay required user verification, it did not properly validate the flag indicating whether that verification occurred.

eBay has since fixed the issue after the researchers reported it.

The second technique, named Silver Pass-ta-key, goes further by allowing attackers to register their own user-verification key with Google’s cloud authenticator.

The attacker first uses malware on the compromised device to force Chrome to re-register it by invalidating its existing verification key or deleting the local file containing its passkey state.

During the re-registration process, the attacker can register a user-verification key they control because the cloud authenticator does not validate whether the new key originated from trusted hardware.

Google then accepts requests signed with the attacker’s key as proof that the victim unlocked the device using a PIN or biometrics. This allows the attacker to access accounts that properly require and validate user verification.

Once the malicious key is registered, the attacker can authenticate from another system without needing further access to the victim’s computer.

The third and most severe technique, named Golden Pass-ta-key, allows malware to obtain the master key used to encrypt all passkeys synced through the victim’s Google Password Manager account.

This master key, known as the security domain secret, is temporarily sent to Chrome when a device registers or recovers access to the account.

Unit 42 initially found that Chrome exposed the secret in plaintext through its internal FIDO logs. Google removed the secret from the logs after the researchers reported the issue, but Unit 42 says it is still sent to Chrome and remains temporarily accessible in the browser’s process memory.

“Although Google removed this secret from Chrome’s logging output following our report, the SDS is still sent to the client and remains accessible in Chrome’s process memory,” explains Unit 42.

“If the attacker forces the victim to re-register with the cloud authenticator and knows the pattern to look for, they can extract the SDS directly from memory.”

The attacker can then use the stolen master key to decrypt the victim’s synced passkey records and recover their private keys. Those private keys can be transferred to another system and used to impersonate the victim and sign in to their accounts.

Unit 42 warns that the stolen master key could also be used to decrypt future passkeys synced to the account. Google’s current implementation reportedly provides no way to rotate or revoke the key, meaning current and future synced passkeys remain protected by the same secret.

While the researchers say passkeys remain significantly safer than traditional passwords, the attacks demonstrate that they do not eliminate the risks posed by malware already running on a compromised device.

Unit 42 recommends that websites require and properly validate user verification. Credential managers should also validate newly registered device keys, harden recovery and device re-registration processes, and prevent master keys from becoming accessible in browser memory.

The researchers disclosed the Google Password Manager attacks to Google and reported related user-verification flaws to affected services, including eBay, before publishing their findings.

BleepingComputer contacted Google for comment on Unit 42’s findings and to ask whether the described attacks have been fully addressed, but a response was not immediately available.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

from the but-it’s-a-cautious-middle-finger dept

Just a few weeks ago, Sony announced that it would stop producing games on physical media starting in 2028 and a very loud portion of Sony’s customers lost their freaking minds. And, in this writer’s opinion, for very good reason. Having no physical media option for your games is going to make game preservation efforts nearly impossible. It makes gaming companies coming up with physical collectables to ship with their games a much more complicated prospect. And, as Sony itself likes to remind us over and over again, a game purchased digitally isn’t a game purchased at all, but rather a limited and temporary license to play a game for however long the publisher decides it should be available.

Given the backlash, it’s not all that surprising that some groups out there are attempting to organize against PlayStation usage blackouts in protest, though we’ll see how far they actually get with that. Given that Sony itself seems to be willing to give those angry customers a giant middle finger through it all, it’s hard to see it having much effect.

“There are various reasons we made this decision, the biggest being that the digitalization of content overall has been progressing, that’s the big factor,” Sony chief financial officer Lin Tao said through an interpreter during a Q&A on July 31. “It’s not just for PlayStation, but for all kinds of content, digitalization is progressing.”

“And so when we think about the future—and we put in a lot of thought and time, and we cautiously considered this—and we came to this conclusion, and we’re going to cautiously move this forward. And to this decision, we have received various opinions and people have strong views, and we understand that the community has put forth those views to us. Games are loved by many people. It’s a form of entertainment that’s loved by people, and it’s connected to people’s fond memories in many cases. And so we understand those emotions. We want to consider that. And in the future digital ecosystem, how do we engage the gamers is something that we would like to continue to explore.”

Now, I want to be clear that the word salad above is also the result of a translation. I have no idea how or if this would read any differently in its original language. But I sure would hope it would, because all those words above say absolutely nothing other than, “Yeah, we don’t care, we’re doing this anyway.”

It didn’t get any better when questions were asked from an investment standpoint. One analyst asked the perfectly reasonable question of what this was going to do to the downstream gaming retailers and Sony’s relationship with them. Tau’s answer was that those retailers can still sell mostly empty boxes.

In response, Tao pointed out that publishers will still be able to ship empty boxes with codes inside to stores in markets like North America and argued that PlayStation hardware will win on affordability.

“About the retailers, there are regional characteristics, and for each regional partner, we try to have a thorough dialogue so that we can end up in a win-win situation,” the CFO said.

No concern for preservation efforts. No concern for the 20% or so customers who still want to buy physical media. No concern for any brick and mortar retail partners and what will happen to them.

It appears Sony is going to listen to anyone but its own customers on this one.

Filed Under: backlash, discs, ownership, physical discs, playstation, video games

Companies: sony

Vibe-coding startup Superblocks announced a multiyear joint marketing agreement with Amazon Web Services (AWS) that enables its tool to be embedded within the private clouds of AWS customers.

That means an enterprise on AWS that subscribes to Superblocks will be able to offer vibe coding to the company’s business users, and those apps will not send data or information externally to model providers or databases. The apps will spin up Amazon Aurora databases within the company’s private cloud, not, for instance, create external Supabase databases, the vibe-coding database of choice.

The apps will also integrate with Amazon Bedrock, the cloud giant’s AI app development/AI gateway/inference platform. Essentially, these apps will automatically fall under IT’s management and security, rather than be rogue applications.

“We’re going to bring it to your data inside your private cloud,” Superblocks co-founder and CEO Brad Menezes tells TechCrunch of vibe coding. “The big thing about that is data never leaves. … It’s their AWS account and basically secure with all of the auditing, all of the encryption, all of the network controls.”

AWS will also help sell Superblocks to enterprises as it does for many of its Marketplace partners. “We support partners where we see strong customer demand and alignment with how customers want to build,” an AWS spokesperson tells TechCrunch.

Still, AWS does not yet have its own vibe-coding agent aimed at business users. It has Kiro, an AI coding agent aimed at developers. Amazon also has an AI assistant, Quick, for business users. But again, that’s more like a Claude Cowork or Microsoft Copilot, rather than a Lovable or Replit.

So this should be a nice boost for early-stage Superblocks, which has 50 employees and raised a total of $60 million as of its Series A, announced in May 2025, backed by Spark Capital, Kleiner Perkins, Meritech Capital, and Greenoaks.

Yet, it’s actually a more significant symbol than that. It’s part of a growing trend where the hyperscaler cloud providers urge their enterprise customers to separate their AI models from all the other scaffolding needed to run enterprise AI and do so on their clouds. They want enterprises to buy AI harnesses (aka agentic apps), AI orchestration, security tools, and the like from them, and not from the frontier providers.

In the past few weeks, Microsoft CEO Satya Nadella has been banging the drum with exactly that message. He’s been telling his many enterprise customers to use multiple models to reduce costs and avoid lock-in. He’s also been preaching that the AI labs are not trustworthy enough to turn to for agent orchestration or app-level harnesses because they may use that data to study a business and later compete with it.

Enterprises perhaps don’t need such warnings. They have already decided to adopt multiple models, particularly frontier Chinese open-weight options. “That is flipped because 60 days ago they were like, I want a specific model. It’s called Anthropic,” Menezes adds.

Open models, for instance, accounted for 29% of all traffic routed through Vercel’s AI gateway last month, a popular tool among enterprises to manage multi-model AI use.

Then, by necessity, all of their AI scaffolding can’t be tied to one provider.

“Having a multi-model strategy across big frontier labs, OpenAI, Anthropic, and open source — and I’d say Chinese open source right now, but also U.S. open source is now starting to come up. It’s a must-have for the CIO,” he says. They want model choice for coding as well as customer service, HR, [and] sales automation, he adds.

Menezes says the movement is so strong, he predicts that “any enterprise that is betting on a single model provider, that executive will be fired.”

So now we’re seeing the cloud providers bring vibe coding for business users into private, secure clouds, too. That’s like a potential second wave after bringing AI coding agents for enterprise developers. “It’s an emerging category with real momentum, and exactly the kind of innovation we support,” AWS tells TechCrunch.