Ninety-Two Accounts Shipped Fake Roblox Hacks Today. Federal Charging Documents Say the Crews Recruit at Sixteen. In April We Got a Sixteen-Year-Old's Portfolio Deleted.
Search GitHub for Roblox script executors and count what comes back. We did, this afternoon.
A hundred repositories matching one naming template. Eighty-two of them pushed today. Ninety-two different account owners. Every one of them wearing the name of a real executor brand that children actually search for — Swift, Phoenix, Arcadia, Axon, Synapse, Fluxus, Solara, Delta, Luna, Nezur.
Two of them are the same repository name under different owners, which is how you know nobody is typing these.
That is a production line, and its customers are twelve-year-olds.
Who is on the other end
Roblox's player base is overwhelmingly children. A script executor is the thing you go looking for when you want to cheat at a game, which is a profoundly normal thing for a thirteen-year-old to want. The lure is not sophisticated because it does not need to be. It needs to be the eighth result for a phrase a kid types.
These repositories contain no exploit. They contain a README, a landing page, and a download button, and the download button goes somewhere else. We walked that chain earlier today on a different family from the same workshop: the repository holds nothing scannable, the button points at a GitHub Pages site on github.io, and the Pages site carries no outbound link in its text at all — the destination is base64, assembled by JavaScript at the moment of the click.
Scan the repository, find a README. Scan the landing page for bad links, find none. Every static check passes and the child still gets the file.
The second thing they want
Here is the part we did not expect to be writing today.
Read the federal charging documents in the Scattered Spider prosecutions. The defendant extradited to the United States this summer is nineteen now; court records describe four intrusions, the first when he was sixteen. A second defendant's alleged involvement may have begun at fifteen or sixteen. Reporting on the group consistently describes it the same way: a loose, mostly English-speaking network of young people, many of them teenagers, who do not break software so much as fool people.
So the same age cohort appears on both ends of this economy. At thirteen they are the mark — the kid downloading a fake Fluxus build. At sixteen some of them are the labour. The crews recruit from the population they farm, which is efficient in a way that should bother everybody, because it means the pipeline is not two problems. It is one problem with two revenue lines.
Nobody has to be a criminal mastermind to run this. You need a template, ninety-two throwaway accounts, and a product teenagers already want.
And now the part about us
In April we published a post scoring ten GitHub repositories that were shipping malware. We reported them. Eight of the eleven accounts we named are now suspended — GitHub reviewed them independently and agreed with us, which we are not going to pretend is nothing.
The post attracted eleven comments in a single day. Several were theatre, signed "Elon Musk" and "Donald Trump." We read the whole thread as a brigade and moved on.
Three of those comments were not theatre.
One said we had reported them for no reason. One said we had destroyed his wife's account. And one said this:
I hope it makes you happy to get a 16 year old student banned from GitHub (which has his entire portfolio on it) just because of source code for a malware, which is clearly written for learning and research purposes only.
A fourth comment asked a question that we have spent the last six months not answering:
did you even consider looking at his profile or README?
No. We did not.
We went back today and checked every account we had named. Eight gone. Three still standing — and one of those three is not a throwaway at all. It is more than twenty original repositories built over a year: an assembler written in C, a userspace TCP/IP stack, a phishing-URL detector, an anti-malware classifier, a biometric MFA project, an EDR — and, beside the EDR, a technique for evading one. Offensive and defensive work sitting side by side, which is what learning the discipline actually looks like.
GitHub removed that person's malware repository and left the account alone. That is the correct call and it is a finer distinction than the one we made. We are not naming them, and we are not going to repeat the identifying details, because the entire point of this post is that we already said too much once.
We cannot confirm that the person in that comment is the person whose account we examined. We can confirm that the shape matches, that a student portfolio is distinguishable from an operation in about one API call, and that we did not make that call in April.
The test we should have run
It costs nothing. It is two numbers.
Look at stars against followers, and look at what else is on the account.
The four accounts in the farm we fingerprinted today hold between one and four repositories each, carry no display name, and have zero followers — while showing fifty-six, fifty-six, fifty-seven and seventy stars. That cannot happen organically. Nobody stars a stranger's repository seventy times without a single person clicking follow.
A real account looks nothing like that. The researcher we used as a control has twenty-nine repositories, one thousand seven hundred and fifty-two followers, and eight stars on the tool that showed up in the same search.
A student looks nothing like it either. A student has a year of commits, a portfolio, an assembler nobody asked for, and a name.
One repository, no name, no followers, a stealer, and a hundred siblings pushed the same afternoon is a farm. Twenty repositories spanning both sides of the craft is a kid learning. If you cannot be bothered to tell the difference before you file a report, do not file the report.
What we are doing about it
The eighty-two repositories pushed today are a live campaign aimed at children and we are treating them as one. The template, the brand list and the account-shape test are all above, deliberately, so anybody can run the same query we did.
On our own error: the correction is published, the method that produced it is published, and the filter is now a check rather than a memory. We are not apologising for reporting malware — eight suspensions says that work was sound. We are saying that "report everything that looks bad" and "look at who you are reporting" are not in tension, and we treated them as if they were.
The uncomfortable arithmetic is that a sixteen-year-old who loses a year of work to a false report is a sixteen-year-old with one fewer reason to stay on the lawful side of this, in exactly the year the crews come recruiting. We would rather not be a step in that pipeline.
Call the whole thing 95% confident. The charging-document details are allegations, not convictions, and the link between the lure population and the recruit population is a pattern across cases rather than a proven mechanism in any single one.
Sources
- GitHub repository search and REST API, measured 2026-10-27: 100 repositories on the shared template, 82 pushed that day, 92 distinct owners. First-party.
- Account shape figures (repositories, followers, stars) retrieved from the GitHub REST API the same day.
- Scattered Spider prosecutions: Department of Justice complaint and contemporaneous reporting on the June 2026 extradition, and reporting on a 2025 New Jersey complaint. Charges are allegations.
- Our own April 2026 repository-scoring post and its comment thread, which this post corrects in part.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.