This was also experienced & discussed in this post and this post.
I’ve also had to private one of my main games due to this, hopefully this issue can be resolved asap!
1 Like
Important Removal And Security
Search KeyBind: Ctrl Shift F
Basic
- Remove any script with the name Halal.
- Disable Third-Party teleports
- Disable Third-Party purchase
- Remove any old/suspicious scripts
- Remove any “OnUnmuted” Connections
- Search for Depricated Methods:
- Game:Service
Most Effective
- Go to settings, Disable The following
- Allow Third-Party Sales
- Allow Third-Party Teleports
How did this happen?
This script is inserted into your game and infects your game. This script does a few things, It first checks the integrity of the client by sending a remote. But if not then they’ll advertise to you. Advertising the bad/infected products. If they cannot advertise to you then they will attempt to teleport them to one of their own games.
Information
This Zero-Day exploited the rendering engine built into the roblox client. This is done by spamming or using a large ammount of text to overload the interface. Various UI’s then start to be disabled and eventually become invisible
The reason the Hackers can show their Gui is because of the ZIndex behavior property. They’re displayed on an entire different system. Meaning one system can die, whilst the other is displaying fine. Roblox’s Gui is still on the first ZIndex, Meaning that the Rendering ability for that ZIndex is broken. But not for the other ZIndex.
Many anti-cheats use this to hide their scripts as when they’re activated or viewed their client ends up being crashed and their topbar/f9 console/core gui crashes together.
This Zero-Day essentially made the CoreGui invisible. Allowing an exploiter to create their own Interface over the top of a Marketplace Gui. Meaning that they could trick the client/player into clicking that same marketplace “Purchase” Button as they’re in the same position.
This exploit has infected alot of games, leading me to think it was a previous ServerSide or exploit which had already infected games. They hook onto “OnUnmuted” DefaultChatEvent and teleport the player to a new game. This game then forces them to essentially verify their client. Purchasing the asset.
Assets IDs
- 3257405595 (Prompt Purchase. Most likely a product)
- 6647166612 (Teleport, A game place.)
- 2489606748 (Owner ID of bad game)
66 Likes
Heard about this issue over Discord, it seems to be getting worse and worse. Maybe ROBLOX should do something about it?
17 Likes
In the same sort of area I suppose,
some reports came in and were discussed on YouTube about games which were able to bypass the purchase prompt entirely and instantly charge users with no confirmation.
Said games would instantly remove the user’s robux upon joining via a dev product, with no confirmation.
This appears to be targetted as the games would then be set to private but still, that appears to be a pretty serious vunerability and should be investigated for being a security flaw.
2 Likes
You can play trustable games, it’s a virus in free models and plugins
6 Likes
This is also discussed here:
1 Like
Couldn’t be some kind of popular plugin that might get modified and put these kinds of stuff? like a plugin developer got hacked or some kind of stuff and someone modified the plugin to include the malicious code
1 Like
it has happened to us before, we have a group named Earth Party and it happened to Discussion Center.
Luckily he was not charged this time.
Says they saw it some time in Feb.
3 Likes
Another historic case of when similar happened was when MeepCity was backdoored by tubers93. Tubers had blocked the leave button with a jumpscare, so when you clicked there you’d just be jumpscared. The only way to leave was forcing close the Roblox client.
6 Likes
Check NonReplicatedCSGDictionaryService. If you see some folders with trash memory as the name, that could be a potential entry point for this virus, and you should delete them.
3 Likes
i feel so bad for every on who literally has been robbed out of there ROBUX hope Roblox fixes this quick
3 Likes
This seems to have been planned over a long period of time. Perhaps the creator of a widely used plugin was compromised and the plugin was updated to be malicious?
The user/users who made these scam places seem to have a group. This group is selling a 100 robux t-shirt and according to the comments, this is what you buy if you press the continue button. This group is pretty sketchy, as the true owner of the group is not in the owner slot, probably to avoid being terminated.
6 Likes
I agree with what you are saying. As one thing that people sometimes do is give all permission to one rank under Owner and put no owner or a bot owner so that they can still manage the funds and do all that but no other harm can come from it.
Regarding’s to this thing what you should do is get an Anti-Virus plugin that will track and alert of all possible threats as it will help you track down what is where it is since one of our devs had a plugin that was compromised and kept putting these scripts in as many hidden places as possible. But I believe that it is an Asset that has been compromised and the require(1234) Has been changed to their new Malicious one. So it will be a little harder to find. (This is just a theory)
1 Like
Prompt purchase guis always on top due to the fact that they are in the CoreGui service, and regular scripts can’t even look at it, but it seems like plugins can look and modify it
Seems a little intense. I just won’t purchase any items.
EDIT: It seems I misunderstood the post. Yes, I won’t be playing roblox for the time being.
1 Like
Does anyone who has seen this in their game mind telling me the list of plugins and models they used? I’m trying to find the asset the user is using to inject code into the games.
1 Like
Roblox should fix this immidiately. This is very malicious.
5 Likes
Here are some posts where people who had this issue shared their plugins:
2 Likes
Is there any place where this can be reproduced or does this occur randomly?
3 Likes
If only Roblox would do something about this instead of endanger their developers and players 
3 Likes