F6 experts have uncovered a campaign in which the WebRAT Trojan is disguised as a VPN for Discord and a program for running scripts in Roblox. For users, the trap starts with the familiar act of downloading an installer, but ends with the risk of handing attackers passwords, active sessions, and access to cameras and microphones.

The scheme targets Windows computers. In one case, the lure was Discord Zapret, advertised as a free VPN; in another, WebRAT was distributed under the name Xeno—an unofficial tool for Roblox. Both promises are aimed at players who want to get around network restrictions or gain capabilities beyond the game's standard rules.

How the lure works

In October 2026 year, attackers created the site discordzapretik[.]sbs, offering Discord Zapret for download. The page included instructions urging visitors to ignore antivirus warnings: supposedly, the protection was reacting suspiciously because the program worked with network filters. This is an important part of the scheme: users aren't simply asked to run an unknown file; they're given an explanation in advance for why they shouldn't trust their security tools.

After the installer is downloaded, several executable files run, and malware gets onto the device. Threat Intelligence analysts at F6 identified it as WebRAT. Following a request from CERT F6, access to the site was blocked in Russia. The source does not say exactly which channels the attackers used to distribute links to the site.

The second lure is Xeno for Roblox. It's described as an unofficial program that lets users run their own scripts in the game. Such scripts may promise features like flying, increased speed, automated actions, or extra resources in some modes. But in this scheme, the file players run for an in-game advantage becomes a way to deliver a Trojan.

The irony here is purely engineering: the instructions suggest turning off your trust in antivirus software right before running an unknown installer. A convenient step for the attack—and a very inconvenient one for the computer's owner.

What WebRAT can do

WebRAT is based on Salat Stealer and combines data-stealing features with remote access Trojan capabilities. It's distributed under the Malware-as-a-Service model—that is, as a malicious tool offered to attackers as a service. For users, that means the consequences aren't limited to one stolen password: the program has a set of tools for collecting data and monitoring the device.

According to F6, the Trojan can steal logins and passwords, cookies, authorization tokens, and session data from popular apps, including Telegram, Steam, and Discord. It also checks clipboard contents and intercepts copied information. If cryptocurrency wallet details or other sensitive information end up there, they could end up in the attackers' hands too.

Another risk is recording keystrokes and entered data. This can include messages and other information users type on the infected computer. Stealing cookies and tokens also puts already active sessions at risk, not just accounts protected by a password.

WebRAT can take screenshots and send them to the attacker's server, as well as access the webcam, record video from it, and transmit audio from the microphone. According to F6, audio and video can be streamed in real time. So an infection can give an attacker a view of what's happening on the desktop, along with access to information that isn't stored in files.

That means the risk isn't limited to a gaming profile. Work email, corporate accounts, or payment details may be open on the same PC. F6 stresses that after running this kind of software, users risk losing access to accounts and confidential information, while attackers may gain control of the device.

Why gamers are targeted

Gaming accounts can have monetary value because of skins and in-game currency. Passwords, active sessions, and cryptocurrency wallet keys may also be stored on the computer. That's why, disguised as a useful add-on, an attacker tries to gain access not just to the game, but to other data available from the device as well.

According to F6, gamers may make it easier to deliver malware themselves when they download cheats or third-party launchers and run them despite security warnings. That doesn't mean every unofficial tool is a Trojan. But in this campaign, the promise of extra features and the request to ignore antivirus software are reasons to stop, not to carry on with the installation.

Researchers were unable to establish reliably how links to the site offering Discord Zapret were distributed. F6 suggests attackers may have used a method similar to the campaign involving the WeedHack infostealer, which was disguised as mods and cheats for Minecraft: in that case, links were shared through short videos on TikTok. This is only a hypothesis about a possible channel, not an established fact about the WebRAT campaign.

Disguising malware as a VPN isn't new in schemes described by F6 experts. In October 2026 year, according to the company, the Android Trojan ZloyRAT was distributed disguised as a fictional service called GosuVPN. Earlier, the RedWing Stealer Android app, designed to attack bank customers in Russia, Uzbekistan, and Kazakhstan, was disguised as a free VPN. These examples aren't technically connected to WebRAT, but they show a familiar trick: a risky file is presented as a tool for access or convenience.

What users should do

F6 advises downloading programs only from trusted sources or developers' websites, and not running executable files from unknown sites. Detailed instructions or a convincing name don't prove that an installer is safe. If a file seems suspicious, it can be checked with antivirus software or an analysis service, and security warnings shouldn't be bypassed based on explanations on the download page itself.

For important accounts, experts recommend enabling multifactor authentication. If you've already run an unknown program, F6 advises disconnecting the device from the network and running a full antivirus scan to check the system for malware. End active sessions and change passwords for important accounts from a “clean” device, not from the computer that may have been infected.