Roblox Hack Gone Wrong: A Parent’s Cybersecurity Battle

0 Hours: The Initial Incident

It all began when my son, eager to enhance his Roblox gaming experience, stumbled upon a YouTube video promising exclusive hacks. One such video, titled "[OP NEW] Blade Ball Keyless Script Pastebin - (ROBLOX) Auto Spam & Auto Crate Exploit," directed viewers to download a file named S0FTWARE.rar from a MediaFire link. The archive, password-protected with "1234," concealed a malicious payload.

The downloaded file immediately raised suspicions. Password-protection for malware is a known tactic to bypass antivirus detection, as confirmed later by a VirusTotal scan showing the file flagged by 38 of 72 security vendors. (VirusTotal Analysis)

1 Hour Later: Malware Activation

Shortly after the download, strange activities began to surface on my system. Unbeknownst to me, the malware executed itself, granting the hackers full access to my personal computer and Gmail account. They moved swiftly:

1. Gained Access to My Gmail Account:
   • Changed recovery options, including backup email and phone numbers.
   • Modified two-factor authentication settings, replacing my Windows passkey.
2. Hijacked My YouTube Channel:
   • Uploaded four malicious videos promoting Roblox malware.
3. Targeted My Amazon Account:
   • Attempted to purchase two MacBook Air laptops, valued at $1,798, to an address in Fresno, California.

5 Hours Later: Discovering the Hack

While attempting to log in to my Gmail account, I discovered I had lost access. Initial recovery attempts were futile; every recovery method had been altered by the attackers. I quickly checked my computer and found my Downloads folder filled with suspicious files, confirming how the attack began.

At this point, a friend warned me that my YouTube channel had been compromised, with hackers uploading malware-laden videos. The uploaded videos, such as "How to GET The Yim Mod Menu After The Battle Eye UPDATE (GTA 5) + Scripts," were used to lure other victims into downloading the same malware.

Additionally, my Instagram account was hacked and used to promote a cryptocurrency scam project. Fortunately, I was able to restore access to my Instagram account and remove the hacker's access.

6 Hours Later: Immediate Actions Taken

Realizing the gravity of the situation, I initiated a damage control process:

1. Disconnected the Infected PC:
   • Shut down and disconnected my computer to prevent further data exfiltration.
2. Contacted TeamYouTube:
   • Reached out via Twitter, explaining the situation and requesting urgent assistance.
   • Received a response with a recovery form to regain access to my channel. This was the first step toward resolving the issue.
3. Began Password Changes:
   • Started updating credentials for all accounts, a tedious but necessary step due to the hackers’ access to cookies and stored passwords.

https://twitter.com/lisa_loo_who/status/1880115853221302276

10 Hours Later: Financial Fallout

A notification from Amazon revealed that the attackers had attempted to make fraudulent purchases. They tried to buy two MacBook Airs and ship them to an address in Fresno, California. Fortunately, I was able to contact Amazon and block the transactions in time.

12 Hours Later: YouTube Recovery Progress

TeamYouTube’s support team sent a second, more detailed recovery form. This required providing extensive information about my channel and AdSense account. Despite the complexity, I completed the process and waited for further updates.

16 Hours Later: Gmail and YouTube Restored

After an intense 16 hours, I received a recovery link from Google. Following the detailed instructions, I regained access to my Gmail account. Shortly thereafter, TeamYouTube restored my channel. The malicious videos were removed, and my account was secured.

Google’s Stance on Recovery

During this process, I learned that Google has strict policies regarding account recovery. If all recovery options are changed and no backup methods are available, Google cannot recover the account. They emphasized the importance of using physical security keys or biometric authentication to prevent such situations.

The Malware: A Closer Look

The malware, later identified as a variant of Vidar Stealer, was designed to:

• Harvest saved credentials, browser cookies, and cryptocurrency wallets.
• Establish persistence by modifying system files.
• Exfiltrate sensitive data to remote servers.

The file’s small size (17 KB) and use of password-protection allowed it to bypass many security measures. Reports on platforms like ANY.RUN confirmed its capabilities and widespread impact. (Vidar Malware Analysis)

Lessons Learned

1. Vigilance with Downloads:
   • Always verify the authenticity of software and avoid downloading files from unverified sources.
2. Implement Robust Security:
   • Use reputable antivirus software and keep it updated.
   • Enable hardware-based two-factor authentication for critical accounts.
   • Use a physical security key or mobile biometric authentication for Google accounts.
3. Regular Account Monitoring:
   • Check account activity frequently and enable alerts for suspicious actions.
4. Educate Children:
   • Teach safe online behaviors and the dangers of downloading unauthorized content.

Final Thoughts

This incident was a sobering reminder of the vulnerabilities we face online. It underscored the importance of proactive cybersecurity measures and the potential consequences of even a single oversight. Through persistence and swift action, I managed to recover my accounts and secure my digital life, but the emotional and logistical toll was immense.

By sharing this story, I hope to raise awareness and encourage others to adopt stringent cybersecurity practices in their own lives.