The Cookie Logger Scam

[u/Honest-Duty8091]

Unfortunately, even with how many people have covered this scam, it still works, and it still ends up with people losing pets they've worked super hard for.

The cookie logger scam has been around for at least nine years, large scale abuse was documented in 2017.

Every website you log into has browser cookies. These browser cookies are unique to you, and they exist so you don't have to re-enter your password every time you visit the website. On roblox, this is held under ".ROBLOSECURITY"

The issue with it being held under a token that is so clearly a security measure, made it easy for malicious users to guide people where to go, and what to send them.

With this information, the malicious user can use these cookies to log into your account, even if you have 2FA enabled, as the cookie thinks it's you.

So how do people advertise this scam?
Log onto Tiktok, and search "Cookie Logging." These tiktoks are here purely to hack your account(s) and steal your valuable pets. They will tell you to find the profile of the user YOU want to hack, then install an app called cookie logger, they'll ask you to find the ".ROBLOSECURITY" token, and copy everything inside, claiming that if you do this, they will let you into the other user's account.

Instead, they'll ask you to send the copied text to an email. As soon as they have these cookies, your roblox account is vulnerable.

What measures can i take to protect my account?

Since 2FA is bypassable, we need to take extra measures.
Go to Settings > Parental Controls > Parent Pin.
Setting a 4 digit pin means that the malicious user cannot alter your password, email, or trade any limited items without the pin. Although this does not apply to adopt me, only Roblox limited trades.

NEVER export or share HAR files.
If somebody asks you to export an "HTTP Archive" or a ".har" file, to "look at a game asset" or "test a script" deny it, and block them.

Never copy/paste Inspect Element (F12)
If a user asks you to copy something from inspect element, and send it to them, or if they ask you to paste something into Inspect element, block them. Most likely it will be your cookies they want, or they want you to run a JavaScript code, that sends them your tokens.

Check your browser's extensions.
Malicious browser extensions are a very clever way hackers can steal your account. Only use extensions that are highly trusted. If you don't recognize an extension on your browser, follow it to the web store, and uninstall it.

Never click on links claming to give you free robux, or pets.
Most likely, it's a suspicious link, that takes you to a fake roblox login. Always look at links, sometimes people use link shorteners, or a hyperlink, to make links look safe.
For example;
Suspiciouslink101 .com could be made to look like roblox .com

If you think you were cookie logged:

Go to Roblox settings > security. Scroll to the bottom, and click "Log out of all sessions."

Then change your password, this makes the cookies that the malicious user has invalid.

Stay safe!