THREE people have been arrested in Ukraine over suspected involvement in a phishing and malware scheme that targeted Roblox, with the Prosecutor General’s Office of Ukraine saying a 19-year-old from Drohobych and two others aged 21 and 22 were taken into custody. The investigation alleges that between October 2025 and January 2026 the group accessed more than 610,000 Roblox accounts to view in‑game items and Robux holdings.
Some of the high‑value elite accounts, identified as 357 in number, were reportedly sold on Russian websites in exchange for cryptocurrency, with authorities estimating earnings of over $225,000. Investigators say social‑engineering lures promised in‑game bonuses but delivered infostealer malware that stole usernames, passwords and tokens, enabling account access.
Police conducted searches at 10 properties, seizing computer equipment, storage devices, mobile phones, bank cards, handwritten notes and more than €2,500 plus nearly $35,000. The defendants face up to 15 years in prison if found guilty, and Infosecurity has contacted Roblox for comment.