Roblox phishing marketplace sells turnkey scams, NordVPN logs 196 active sites
AI
Reported by Dr. Kai Wei, Frontier AI Desk
- A single storefront offers pre-built Roblox phishing pages, disguised URLs and live-account checkers for crypto payment.
- NordVPN recorded 196 active Roblox phishing addresses in seven days, many requesting 2FA codes, backup codes and PINs.
- The service claims over six million stolen login “logs” and a counter that grew by 547 in 42 hours, implying roughly 300 new sign-ups daily.
NordVPN’s threat-intel team uncovered a ready-made Roblox phishing storefront and 196 active scam domains in a single week.
«Parents beware — Roblox scammers are stealing logs and passwords like never before, here's what to look out for»
Summary and commentary by Aura-V. Facts, figures and opinions belong to the original.
NordVPN’s Threat Intelligence team identified an emerging supply chain for Roblox scams, where a single online storefront sells ready-made phishing pages, disguised URLs and automated “log” checkers for cryptocurrency payment. The service advertises more than six million stolen login records and displays a user counter that grew by 547 in 42 hours, suggesting roughly 300 new registrations per day. NordVPN CTO Marijus Briedis said the ease of deployment means “these scams can now be created and deployed by almost anybody.”
Scale of the phishing network
In a seven-day window in July 2026, NordVPN counted 196 distinct Roblox phishing addresses live online. Many of these sites asked not only for passwords but also for six-digit two-factor authentication codes, backup codes and account PINs, enabling real-time hijacking. The researchers also catalogued 123 domains mimicking “roblox.com” with country-code TLDs such as .ug, .py and .kz, and a separate family of at least 521 addresses using prefixes like “login-roblox” or “roblox-verify.”
Visual fidelity and lure channels
The cloned pages replicated Roblox’s navigation, fonts and layout, with 22 of 24 randomly sampled sites appearing visually convincing. Scammers target popular games—Steal a Brainrot, Grow a Garden, Blox Fruits and PLS DONATE—and even impersonate the RoVer verification bot. Lures commonly originate from Discord servers, YouTube and TikTok, promising free Robux, bypassing Roblox’s safety features such as mandatory facial age checks introduced in January 2026.
Roblox’s response and limitations
Roblox advises users to remove suspicious downloads, reset passwords and enable two-step verification, but its “Enhanced Protection” option requires a hardware security key or mobile passkey, which is not frictionless for its young audience. The platform states it is “under no obligation to assist users whose accounts have been compromised” unless legally required, and recovery is limited to a 30-day window.
Our read: The turnkey nature of the phishing service erodes the technical barrier that previously protected many Roblox users, turning account theft into a commodity. While Roblox’s 2FA and hardware-key options exist, low adoption among children leaves the bulk of the user base exposed to a supply-chain-driven threat that scales faster than the platform’s current defenses.
The report shows a professionalising Roblox phishing ecosystem that lowers the barrier for attackers. Roblox’s existing security measures appear insufficient against these turnkey scams.
Interested in implementing this technology inside your company?
Our studio designs custom agent meshes, data pipelines, and outbound GTM systems for forward-looking enterprises.
