This was previously posted by DrEgguin, but I am reposting this topic as I believe it didn’t gather enough attention when he posted.
I fell for this method by being told someone wanted to use my character in a render, and was asked for my character’s texture. By following the instructions of a youtube video(link removed, not sure if it’s more dangerous to show)(which seemed legit with 70K+ views and full comments), I went to a link that seemed harmless: the texture of my roblox character. But embedded in this image was my .ROBLOSECURITY, when I sent the image over on discord I had given access to my account.
Fortunately, they had only intended to steal my limiteds and hadn’t of noticed my group funds. When they DMed me through another discord account asking me to enable trades (if I didn’t have account PIN enabled, they would’ve been able to do this themselves), I knew it was too coincidental and immediately knew I was tricked, signed off on all other sessions and searched how this method worked.
Basically, never use javascript links on roblox, and be careful when being told to follow instructions, what may seem mundane could be giving up account access. If I had been more logical, I would’ve known there are plenty of other ways that don’t require me to get my character’s textures.
Edit: Going to any js link they post is how they get you, the instructions may be to send an image or an obj file, regardless they’ll log your cookies when you’ve went through the link.