{
  "id": 18051810,
  "title": "Rig of Troy: A Suspicious Recovery Script Hidden Inside Roblox Toolbox Models",
  "url": "https://urgent.news/2026/11/04/rig-of-troy-a-suspicious-recovery-script-hidden-inside-roblox-toolbox",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-04T01:56:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/fireson/rig-of-troy-a-suspicious-recovery-script-hidden-inside-roblox-toolbox-models-1jp4"
  },
  "original_language": "en",
  "account": "An investigation revealed a hidden script inside Roblox Toolbox models. Developers found suspicious R6 models and animations in the Toolbox. One model had a script called Runtime.lua in its Right Arm object. Further analysis showed similar structures in multiple models from different creators. The script installed an interface inside the PlayerGui, hiding it under MovementElevateAction. The interface displayed instructions encouraging the execution of an external command. The hidden script also contained a fingerprinting mechanism and checked conditions that could stop the installation. The investigation did not confirm the final payload's purpose, but it raised concerns about the trustworthiness of Roblox Toolbox assets.",
  "summary": "An investigation into suspicious R6 models, hidden GUIs, remote code loading, and a possible social engineering attack. 1. It Started With an Animation R6 models and animations in the Roblox Toolbox. Everything seemed normal until I inspected one of the models more closely. Inside the character's Right Arm , I found something unexpected: a script called Runtime.lua , accompanied by a complex…",
  "key_points": [
    "Suspicious script discovered in Roblox Toolbox models",
    "Runtime.lua script found in Right Arm object of multiple models",
    "Interface displayed instructions to execute external command"
  ],
  "editors_take": "The presence of malicious scripts within common community assets undermines the security of the Roblox ecosystem and forces developers to question the fundamental trustworthiness of the platform's shared resource library.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}