LucentWaves

LucentWaves, also known as BloxDevs, VIK Games, Motive Creations, and Bloxtensions, is an account hijacker and phisher that has used multiple methods to steal accounts and their Robux and limiteds. They have operated by using external verification scams, malicious bookmarks, purchasing the ownership of established Roblox website extensions and updating them with malicious code, and other methods. They also create unique extensions and advertise them under false pretenses on the Roblox website, or by impersonating other notable website extensions. 
Currently, they are most notable for the ongoing VIK Games / Motive Creations acquisitions scam that was addressed by Roblox on the Developer Forumhttps://devforum.roblox.com/t/psa-bookmarklet-verification-scam/2945496, where they targeted developers with offers to acquire their experiences, leading them into Discord servers to ask them to verify with malicious verification (such as "RoLinker") or bookmark code execution. Another variant of this scam involves them asking for permission to use clothing items created by the victim in one of their games and offering to pay money for it. They are also the purchase behind the 2022 SearchBlox incident which updated the extension to have malicious phishing code that stole Robux and limited items.
They were also known the purchase of the BetterBlox extension, which was subsequently updated with malicious code to hijack its users' accounts and steal their Robux.https://github.com/SegoGithub/f--k-bloxtensions They also gained some notoriety from promoting "RoTracker" and similar extensions. 
They have also gone by Hardware Productions, BloxDevs, and BloxUnits. Some of their malicious projects include Roblox Daily Rewards, RoLink/RoLinker, RoTracker, RoExporter, and RoFinder. 
LucentWaves is believed to be a singular individual. They have commonly used "rawerrorlog" as an internal site, but have a number of webpages, Roblox accounts, groups, Discord accounts, and extension pages for their scams, which change names often. They also go by "lucentwavesx",https://twitter.com/JullianRBLX/status/1730461944761684379 "UnstoppableLucent", and "szdevs". 
== Background ==
=== Experience acquisitions scam ===
In 2024, LucentWaves has been utilizing a method regarding reaching out to experience developers (typically of experiences that were popular but not actively updated) via the Roblox messages system using numerous accounts to offer to purchase rights to the experience, promising to continue updating the experience. The most known organization names they have used for this scam are Motive Creations and VIK Games or similar, but they have also used other names.
Victims are asked to join a Discord server and to verify with various methods. These methods were all various ways intended to take control of the victim's Roblox account, though mostly via a "bookmarklet" phishing method. With the account in control, their login information would be changed to attempt to lock the original owner out of their account. Their active experiences would be stolen and closed, republished under the group owned by the scammer, and linked to on the original experience's page. In some cases, the victim's Roblox account would also be used to take actions that would have the account deleted, or the email would be entirely removed from the account, making it more difficult to retrieve through Roblox support.https://twitter.com/one_who_finds/status/1783268602226889081 
A developer who was a victim to the scam, going by @one_who_finds on Twitter, addressed having their account stolen on April 18, 2024 from the scam.https://twitter.com/one_who_finds/status/1781050042855420190 Over the following days, they made multiple Tweets addressing dealing with the scam and intending to bring awareness of it. These posts began to be spread around the community for Roblox on Twitter; notably, they were brought more attention from a post by Roblox RTC discussing the situation.https://twitter.com/Roblox_RTC/status/1781807011585298746 On April 21, 2024, @one_who_finds made a post noting that the victims of the scam that had their experiences copied to the Motive Creations group were being terminated.https://twitter.com/one_who_finds/status/1782047968834502943
Due to the amount of experiences and developers being affected by the scam, Roblox made a statement on the Developer Forum to raise awareness of the scam to developers.
=== Bloxtensions ===
LucentWaves has used web extensions to hijack accounts, mostly going by the handle of Bloxtensions. 
Bloxtensions has been observed to operate via two primary methods:
# Purchasing established extensions from legitimate developers, then updating the extension with malicious code
# Creating original extensions with malicious code from the start, and promoting them on the Roblox website to gain a userbase, then activating the malicious code 
When the malicious code is present on the extension, it does a number of actions on accounts to take or make use of its valuable assets, such as limited items and their Robux. This is done after requesting or obtaining the account's .ROBLOSECURITY cookie through deceptive means, which bypasses all authentication and grants them access to a Roblox account. Some of these actions notably include:
* Changing the e-mail and password
* Trading the account's limited items to various other accounts
* Paying out all funds of owned groups 
* Buying products such as passes for the exact amount of Robux that the account has
* Changing place thumbnails and uploading free-to-upload assets with inappropriate images that will very likely ban the account
The extensions operate their scam by calling to a "rawerrorlog" website that contains the actual malicious code to run. This site is updated as needed by the scammers to activate and deactivate the malicious code at any time, and also presumably to easily reuse the same malicious actions for their extensions.
==== Extension purchasing scam ====
A major method used to obtain extensions with large amounts of users that was used by LucentWaves was to reach out to legitimate extensions. Under the name "Bloxtensions", they reach out to the creators of extensions on the Chrome and Firefox extension/add-on stores to ask to purchase the extension in large amounts of USD, promising to improve and update the extension. They reassure via offering to pay first, then request that the creator transfers ownership of the extensions to them after payment. Those who have had their extensions bought by Bloxtensions have implied they did follow up with their payment. 
Once the extensions are acquired by Bloxtensions, it is updated to be able to run malicious code at any time. For most users, this will result in it auto-updating and making their account vulnerable to being stolen. 
This process is what caused the 2022 SearchBlox incident, resulting in thousands of accounts being stolen.
==== Original malicious extensions ====
Often aided by accounts stolen by their successful extension purchasing scams, Bloxtensions promotes original extensions that are inherently malicious from the start. 
As of September 16, 2024, they have 15 malicious extensions on the Microsoft Edge store under the account "BloxDevs". These claim to do a variety of tasks; some are only simple changes that appear to do as they claim, but some promote impossible features, such as a chance at free Roblox Premium or allowing players to obtain the Ban Hammer or a Dominus. Formerly, these extensions typically advertised either the ability to export or retrieve any Roblox asset such as classic clothing (often advertised as "clothing template exporters" or "copy any clothing"), or to find any Roblox user in a certain experience (which was not possible at the time of the extension being promoted).
These extensions typically do provide their advertised functionality in the case that it is possible; however, a number of the extensions promote features not possible to implement, such as giving out paid items for free or botting a user's followers to large number. Regardless if the extension does what it claims or not, the backdoor for malicious code to run is present at all times, enabling the scammer to activate malicious content in an extension that otherwise did not appear to be malicious. Even if an extension does what it says it does, it may still have the ability to steal accounts. 
Some of those original malicious extensions included "RoTracker", "RoFinder", "RoExporter", and "Roblox Clothing Template Exporter". Due to major exposure of these extensions being phishing scams, however, these names appear to no longer be used publicly (they are still used internally). Recent extensions by LucentWaves appear to favor a more straightforward name on what it claims to do, e.g. the extension claiming to give players the Ban Hammer is named "Get a Ban Hammer on Roblox". These recent extensions also make heavy use of stolen logos for their icons, such as those of the Name Snipes group or the Roblox Fandom Wiki, or from fanart taken off other sites such as a "Roblox GTA 6 logo" from Reddit.https://www.reddit.com/r/roblox/comments/18gtgpv/roblox_gta_6_logo/ 
They had formerly used the user advertisements feature to promote their extensions, which leads to various groups for their extensions. Some of the malicious extensions have used the Robux of the accounts they take control of to purchase and run these advertisements. More recently, they have shifted to messaging users via the Roblox website with bots to advertise their extensions, along with some of the extensions explicitly stating that they will use the user's chat conversations to promote the extension further.https://archive.is/LV5dB (archive linked for safety - do NOT install this extension!)
LucentWaves scam message daily rewards extension.png|An example of a bot account sending out messages on the Roblox website promoting the malicious Roblox Daily Rewards extension
Malicious extension user advertisement.png|A user advertisement for a group promoting malicious extensions, advertising the ability to steal clothing
Malicious extension user advertisement 2.png|A user advertisement for a group promoting malicious extensions, advertising the ability to search experiences for certain accounts
Since these extensions are often repeatedly taken down, they are constantly reuploaded to extension stores. The BloxDevs account on the Microsoft Edge add-ons store appears to be an exception to this, as it has remained active and unmoderated for months. They also change website domains on a regular basis, but most of the malicious code still leads back to the same few website servers.
==== Impersonation extensions ====
LucentWaves has also been observed to create extensions impersonating other extensions that are or were legitimate, particularly on the Mozilla Firefox Add-ons store. Some of these copies fully claim to be the original extension with all of its features, while others advertise completely different functionality (usually for copying any Roblox asset or to find any user in a certain experience).
== History ==
In October 2018, a video was published on YouTube that was footage purportedly taken by LucentWaves, who had stolen someone's Roblox account to drain its Robux and then take inappropriate actions on the account to have it terminated.LucentWaves 2018 video: https://www.youtube.com/watch?v=-64cQnw4AyI 
In February 2019, Roblox YouTuber published a video where he has an interview with someone claiming to be LucentWaves. In the interview, the interviewee also claims to be behind scams common in late 2018 to early 2019, such as the "avatar texture" scam, and had also shown Faave another video they had taken of scamming a user out of a Dominus Vespertilio. These claims are not verified.Faave video from 2019: https://www.youtube.com/watch?v=3DU-KjZ4ahw
LucentWaves claims to be behind the 2022 SearchBlox incident, and the process of the incident resembles the Bloxtensions phishing model closely. However, details on the purchase that led to the malicious code is unclear to verify.
The developers of RoGoldhttps://twitter.com/AlexOp_/status/1596807032317022208 and RoSeal had been reached out to concerning an offer to have their extensions purchased for reasons LucentWaves/Bloxtensions had been known to use, but the developers were not successfully coerced.
One of the Discord accounts used in discussing the purchase of extensions was created in March 2023. It has been observed that some of the development of the current malicious extensions and code being used by LucentWaves had been worked on around early August 2023.
In September 2023, LucentWaves (via Bloxtensions) successfully bought the "BetterBlox - Roblox Improved" extension and were given ownership. The extension was subsequently updated to run malicious code to make accounts using the extension purchase items to steal their Robux. By October 2023, the proxy site "rawerrorlog" that was used for running the scam was updated to no longer function.
In October 2023, LucentWaves (via Bloxtensions) created a new developer account on the Firefox Addons store and published new malicious extensions impersonating RoPro, Roblox Plus, and SearchBlox.
At the end of November 23, LucentWaves began using a Discord account "lucentwavesx" to reach out to extension developers (primarily for Microsoft Edge) to offer to purchase their extensions.
Instances of the "Motive Creations" acquisition scam messages began to be discussed in the development community in mid-April 2024, as many developers were receiving messages from bot accounts promoting it. Roblox RTC brought attention to posts by Twitter user @one_who_finds regarding Motive Creations on April 20, 2024, and made additional replies in the following days. Later, it was observed that @Motive_Creation on Twitter, the Twitter account for Motive Creations, was formerly used as a Twitter account for Bloxtensions, and had been commenting threats on posts by legitimate extension developers (such as , the creator of RoSeal) that had addressed LucentWaves' scam methods in the past.https://web.archive.org/web/20231218120900/https://twitter.com/Bloxtensions/status/1736517273647550512 / https://web.archive.org/web/20240422033045/https://twitter.com/motive_creation/status/1736517273647550512 are from the same account.
On April 25, 2024, Roblox made a post on the Developer Forum addressing the verification scams, which are highly likely in response to the verification scam methods LucentWaves was using for Motive Creations. The Motive Creations group on Roblox was also locked later that day. Replies to Roblox's Developer Forum post on the verification scam mentioned new groups the Motive Creations scam had allegedly moved to, including "Hardware Productions" and "VIK Games", and that bots were still sending out similar messages to attempt to lure more people into the scam. 
In September 2024, accounts began sending messages to random Roblox accounts promoting malicious extensions on the Microsoft Edge add-ons store created by BloxDevs. One of the major extensions promoted, "Roblox Daily Rewards", also explicitly states in its description that the extension will send advertisements for the extension to all users one has open chat conversations with.
== References ==
Category:Scamming techniques