Also says it is created by @sleitnick that is a known plugin creator and his plugins are totally not malicious in anyway. Looks like the actual group is trying to impersonate.
1 Like
How has this not been shut down yet?? He has multiple groups that are obviously meant to impersonate well known developers and teams.
I also found this:
Roblox Studio+
Malicious Plugin: 5871957158
Original Plugin: 144358935
Malicious Script Location: PluginGuiService > PluginGui > Layers > UIListLayout > FX
Malicious Action:
require(5870849966)
Malicious Required Module: 5870849966*
*Suspicious obfuscated code. Assuming this is the source of the backdoor that multiple posts above have connected with the Updated/New mark at the top of the plugin thumbnail.
The plugin was published by a group named ROBLOX to make it seem as if the official ROBLOX account created it.
ROBLOX Impersonation: 8135004
1 Like
I hooked the functions of the obfuscated module and it seems that it was only calling require to this module MainModule - Roblox
It has a GUI for a server side backdoor service called “Ubuntu SS” which I have never heard of here is a picture.
The logging place for HTTP logs is
and the group for whitelisting seems to be
The module also seems to contain some webhooks URLs but they seem invalid. I am not sure if they were previously used for logging and were removed, if they were abused and removed thus or are just decous.
2 Likes
Over half of these plugins are real, without any malicious intent.
1 Like
No plugin from the list is malicious.
I took a look at those plugin’s source and did not find anything. Also I see you have already posted 3 of those plugins already on this topic.
I just read through it’s source, turns out it was a mistake on my end. Sorry for re-posting, didn’t realize that.
1 Like
Building Tools by F3X (Plugin)
Malicious plugin: 6240474358
Original plugin: 144950355
[FIXED] Realism Mod
Malicious plugin: 6792716290
Original plugin: 400812710
Load Character Lite
Malicious plugin: 6789266789
Original plugin: 752585459
to be continued…
Someone apparently made a copy of AlreadyPro’s Load Character Pro under the name of “AlreadyPro” a group owned by a deleted account. Reported the plugin for using the code of AlreadyPro and also malicious code.
Malicious:
Original:
1 Like
Load Character Pro
Original: 4489766693
Malicious: 7070331213
Drops a malicious script. Malicious plugin creator attempting to impersonate AlreadyPro.
1 Like
Yes
I would also like to report this one as well: Malicious Plugin
It’s a group that impersonates his name to promote their fake plugin.
1 Like