This man has made over 200k+ Robux by making this malicious script that inserts a (fake?) 50R$ admin command into infected games

I’m gonna test that right now hold on

1 Like

Ok so here’s what I found in the Output

And here’s what it looks like in the scripting box

The thing is, that script doesnt even exist in the Explorer! How in the world is that even possible?

This is the Model that id number links to
https://www.roblox.com/library/4921021305/PluginAsset
Conveniently the owner is terminated

It might be the product id try MarketplaceService:GetProductInfo(), I’ll test it and see.

1 Like

Update me on it because I don’t know how to test that

It’s probably parented to another part of the game that isn’t visible via the explorer. You could use this method I stated previously to see where it is.

1 Like

All I’m seeing is this e.e

It has something to do with ThirdPartySales but the thing is I have it turned off so how is that even possible that they have a Marketplace product in my game?

1 Like

A method I use is by searching Welding, Fix, Weld or Debounce into explorer and delete any script with those names, they normally will appear “empty” or saying something about “this script is from ROBLOX” (which is not true) also any unnamed scripts could be the backdoor.

Can’t confirm.

The module seems to have been obfuscated with Luraph.
I am not sure of how to dump Luraph’s constants but what I could find is that it also requires this module

1 Like

I found Debounce, but the script is blank, nothing inside the script. What do I do with it?

Are you absolutely sure?

Because a lot of these scripts just indent soooo much that the script has a horizontal scrollbar.

1 Like

Just delete the entire script.

Yes I’m absolutely sure because the script has no scroll bars it’s literally a blank script named Debounce inside a part that I have no idea how it got there. Also I can’t revert to an old version because I have no clue how long it’s been like this until I finally tested the game for a while, this is what my version history looks like:

1 Like

Did you find anything? I tried to search what you wrote and it showed nothing for me…

No its not a product Id, it a module script Id, why not just delete that script.

How do I find that module script id though?

@sjr04 linked it in his post above.

I got the model, it looks like this


How do I decompile that

1 Like

Also I did delete the script and nothing happened, the marketplace admin pop up still comes