9/3/25, 9:58 PM

According to Darktrace, researchers from Cado Security Labs (now part of Darktrace) identified a Python Remote Access Tool named Triton RAT, an open‑source tool controlled via Telegram that targets Roblox credentials. The malware’s features include keylogging, remote commands, stealing saved passwords, and specifically searching for Roblox security cookies (.ROBLOSECURITY) across major browsers for exfiltration, which could allow session hijacking and bypass of 2FA.

The TritonRAT code also creates VBScript and BAT scripts to enable persistence and uses a ProtonDrive.exe payload to maintain presence, with three scheduled tasks set to run at user logon. Darktrace notes the dropper and loader chain includes a Python execution path, Base64/XOR obfuscation, and a subsequent AutoIt loader that injects into a legitimate process to steal data and exfiltrate via Telegram Bot.

The piece highlights the threat as part of the broader risk to large user bases like Roblox and emphasises reinforcing endpoint protection and credential security practices. The report was published on 27 March 2025.