Handling Suspicious Scripts

Found a script that feels off, or worried you ran one you should not have? This guide covers how to spot a suspicious script and exactly what to do — before and after running it.

Signs a script is suspicious

Trust your instincts and watch for:

• It asks for your Roblox login, an email, or any personal detail.
• It is entirely obfuscated with no readable parts and no explanation of what it does.
• It came from an anonymous or brand-new source with no reputation.
• It does something unexpected on run — opening links, prompts, or your friends getting spam.

Before you run it

If a script trips any of those, do not execute it. Verify the source, compare it against a copy from a trusted hub, and if you want extra assurance, check it with antivirus and script scanners. There is no prize for being the first to run an unverified script.

If you already ran a bad script

Act quickly — the main risk is account theft via a stolen session cookie:

• Change your Roblox password immediately from a device you trust.
• Enable two-step verification if it is not already on.
• Sign out of all other sessions / "log out everywhere" in Roblox security settings.
• Run a full antivirus scan on your PC in case the script dropped malware.

Then lock it down

Once you have contained it, read securing your Roblox account to harden the account properly, and how to recognize a safe script so it does not happen again.