Ukraine says three suspects stole and sold access to 610,000 Roblox accounts using infostealer malware and stolen session tokens

Updated: 2026.09.16 1M ago 1 sources

Threat Actors & APTs Malware Scams & Fraud

Ukrainian prosecutors say three suspects stole access to more than 610,000 Roblox accounts and sold them online, affecting users whose gaming accounts contained virtual currency or valuable in-game items. Authorities say the group operated from May 2025 to April 2026, used information-stealing malware disguised as game cheats or free bonuses, and reused stolen session tokens, also called cookies, to log into accounts without passwords. Investigators say the suspects advertised the accounts on Russian platforms and Telegram, took cryptocurrency payments, and generated an estimated $480,000.

Why it matters: This matters to children, teens, and families using Roblox because stolen session tokens can let attackers hijack accounts even if the password was not directly stolen. Affected users should sign out of all sessions, change passwords, enable stronger account protections, and avoid downloading cheats or unofficial game tools.

Sources

Three Ukrainians to face charges for alleged hack of 610,000 Roblox accounts

2026.09.16 100% relevant

This article establishes a distinct criminal account-theft case centered on Roblox, specific suspects in Ukraine, infostealer-delivered session-token theft, and law-enforcement charges rather than a product vulnerability or previously tracked breach.