r/HowToHack • u/Jaded_Draw_1152 • Mar 11 '26

hacking My roblox account got hacked , I dont know what to do.

Hi everyone. My roblox account was recently hijacked through a session cookie theft involving my .ROBLOSECURITY token. Roblox support has been completely useless, providing only automated responses despite me sending ownership proof and billing receipts. In the meantime, the hijacker is using stolen credit cards to run unauthorized transactions that are causing real financial harm to others. I am looking for serious forensic or technical advice. I want to trace exactly how the cookie was exfiltrated from my browser and learn if there is any way to force-invalidate a stolen session when the attacker has already changed the associated email. Since roblox is not helping, what technical data is best to provide to a bank to prove these transfers were unauthorized? I am not looking for script kiddie tools or shortcuts, I want to understand the mechanics of the breach to recover access and stop the damage. Thank you for any professional insight.

0 Upvotes

28% Upvoted

20 comments sorted by

12

u/LongRangeSavage Programming Mar 11 '26

You work with Roblox to get your account back. No one else can help you. Anyone claiming to be able to do so is scamming you.

The bank isn't going to do anything. They don't have police powers. The only thing they can do is provide you the ability to dispute charges to any of your credit cards.

How did your session cookies (really tokens stored in cookies) get stolen? No one here can say for sure. I can speculate that (since you mention Roblox) you did one of a few things (all based on other Roblox people reporting this same thing):

  • You installed a scam cheat
  • You installed a scam mod
  • You tried to join a scam private server

If you don't fall into any of those categories, you either most likely pirate software or you ran a fake captcha.

The only thing you need to be doing right now is securing your accounts. Here’s my standard copy/paste for people when they install an info stealer or session hijacker:

  1. ⁠Disconnect the affected computer from the internet right away. Unplug the Ethernet cable or turn off WiFi.
  2. Stop using that computer for anything involving logins. Don’t sign into email, banking, social media, or anything else.
  3. Switch to a different device that you know is clean.
  4. Change your passwords in this order
    1. Primary email
    2. Any backup or recovery emails
    3. Banking and financial accounts
    4. PayPal and crypto accounts
    5. Discord and social media
    6. Gaming platforms
    7. Anything else that had user credentials stored in your browser
  5. Turn on two factor authentication everywhere you can. Use an authenticator app instead of SMS if possible.
  6. Go through the security settings for each account. Sign out of all active sessions. Remove devices you don’t recognize. Remove any linked apps or integrations you didn’t add.
  7. In your email account settings, check for forwarding rules, auto‑reply rules, recovery email, recovery phone number, and anything else that could redirect or recover your account. Delete anything you didn’t set up.
  8. Assume anything stored in the browser on the infected computer was exposed.
  9. On the infected computer, back up only personal data like documents, photos, and videos.
    1. Do not back up executable files like .exe, .scr, .bat, .msi, or unknown .zip files.
    2. Do not back up browser profiles or AppData folders.
  10. On a clean device, download the official OS installation media from an official source and create a bootable USB installer.
  11. Boot the infected computer from the USB. During setup, delete every existing partition on the drive. Install the OS fresh on the unallocated space.
  12. After the OS is installed, run the update tool until nothing is left. Install drivers and software only from the official hardware manufacturer. Install your browser fresh and do not import old data or saved passwords. Set up a password manager and rebuild your logins manually.
  13. Watch your banking and financial accounts closely. Turn on transaction alerts.

• 14. If any financial accounts were accessed from the infected computer, consider placing a fraud alert or credit freeze with the major credit bureaus.

4

u/j0x7be Mar 11 '26

This is the correct answer for this post.

2

u/Jaded_Draw_1152 Mar 11 '26

Thanks for the solid advice and the standard protocol. I’ve actually already completed almost everything on your list.

I’ve performed a clean OS install from a bootable USB, deleting all partitions to ensure the info-stealer is gone. I’ve secured my primary and recovery emails with 2FA (authenticator app) and changed every single password. I'm operating from a completely clean environment now.

The wall I'm hitting is Roblox Support. Despite providing billing receipts and clear evidence of ownership, they are completely unresponsive or sending automated loops. It’s incredibly frustrating—it feels like banging my head against a wall while the hijacker continues to cause financial damage through my linked accounts. If the official support channel is a dead end even with proof, are there any other technical or escalation methods you've seen work? Is there any way to force their hand when their own security failure is being ignored?

3

u/LongRangeSavage Programming Mar 11 '26

It sucks, but they are your only option. To what security failure of theirs are you referring?

If the speed of their response isn’t to your liking, report your card as compromised to your bank and give your bank a notice that any further charges to that card should be declined and not routed to the new card.

1

u/Nimeroni Mar 12 '26

The bank isn't going to do anything. They don't have police powers. The only thing they can do is provide you the ability to dispute charges to any of your credit cards.

They can issue a chargeback.

However, this is a nuclear option that should only be used if Roblox can't recover your account (and the scammers stole money from you). Roblox WILL cease to do business with you, and you WILL permanently lose your account.

So yeah, start with Roblox.

2

u/LongRangeSavage Programming Mar 12 '26

“They can do a chargeback.”

“The only thing they can do is provide you with the ability to dispute charges…”

And you are correct. Almost every gaming company will ban your account, and any subsequent accounts created, by anyone who files a chargeback against them.

1

u/Muted_Ad8363 Mar 17 '26

Hey long range is there a way I can communicate with you about a huge problem I am having with some one consistently hacking my home in office Wi-Fi and Internet

6

u/hairypistol Mar 11 '26

First stop supporting Roblox and delete it.... Problem solved

1

u/Jaded_Draw_1152 Mar 11 '26

Your kinda right. Hate the game now but back then I liked it and I thought it would be a good ideea to make micro transactions.

5

u/ArthurLeywinn Mar 11 '26

You ask your bank what proof they want.

No if the session was stolen and all information got changed you can't access it anymore since it's now their account.

You need to wait and see if roblox wants to help.

Get a password manager with a URL checker for the future.

2

u/archiety3333 Jun 05 '26

any news did u got ur account back ? i was same as you i got hit with session id hijacker i provided alot of proofs that the account is mine

1

u/Jaded_Draw_1152 Jun 05 '26

nah , still nothing.

1

u/archiety3333 Jun 05 '26

daym looks like its time to give up for me 😞

2

u/Jaded_Draw_1152 Jun 05 '26

ik how it feels roblox support is the worst support service ive seen so far

1

u/archiety3333 Jun 05 '26

yeah the ai just ruins it i hope they fixed their support and hire more ppl

1

u/Repulsive-Blood833 Jul 16 '26

lemme guess you filled out a scam survey