FAKE XENO AND ROBLOX UTILITIES USED TO INSTALL WINDOWS RAT

Summary from the TLDR InfoSec newsletter

Researchers at Microsoft Threat Intelligence have detected a malware campaign in which attackers are using trojanized executables, masquerading as Roblox and Xeno utilities, and circulating them through chat rooms to install malware on users' systems. The malware installs a portable Java runtime, which runs a malicious JAR that relies on LOLBins to download and run a remote access Trojan (RAT). The RAT then tries to delete traces of the initial infection and add Windows Defender exclusions for the malicious files.