Rig of Troy: A Suspicious Recovery Script Hidden Inside Roblox Toolbox Models
An investigation into suspicious R6 models, hidden GUIs, remote code loading, and a possible social engineering attack. 1. It Started With an Animation R6 models and animations in the Roblox Toolbox. Everything seemed normal until I inspected one of the models more closely. Inside the character's Right Arm , I found something unexpected: a script called Runtime.lua , accompanied by a complex…
An investigation revealed a hidden script inside Roblox Toolbox models. Developers found suspicious R6 models and animations in the Toolbox. One model had a script called Runtime.lua in its Right Arm object. Further analysis showed similar structures in multiple models from different creators. The script installed an interface inside the PlayerGui, hiding it under MovementElevateAction.
The interface displayed instructions encouraging the execution of an external command. The hidden script also contained a fingerprinting mechanism and checked conditions that could stop the installation. The investigation did not confirm the final payload's purpose, but it raised concerns about the trustworthiness of Roblox Toolbox assets.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
