A new scam is spreading among Roblox and MM2 players on Discord and other platforms. Scammers send you a command that starts with mshta and give you a reason to run it on your PC. Whatever reason they give, the command does the same thing: it downloads and runs a program from the scammer's website, and that program is used to take over your Roblox account and steal your Robux and in-game items.

What is mshta and why is it dangerous?

mshta.exe is a program that is built into Windows. It runs HTA files (HTML Applications): web pages that contain code. Give it a link, and it downloads that page from the internet and runs the code in it. Unlike a normal website in your browser, an HTA is not locked in a sandbox. It runs with the same permissions as you, which means it can:

• Download and start other programs, such as account stealers or remote access tools.
• Read files on your PC, including the data your browsers store.
• Steal your browser cookies, including the cookie that keeps you logged in to Roblox.
• Steal saved passwords and your Discord login token.
• Stay on your PC and keep running after a restart.

Because mshta is a real Windows program, it does not look suspicious, and the code comes straight from the scammer's server, so they can change what it does at any moment. With your Roblox cookie they can log in as you without your password and without passing two-step verification, and then trade away your MM2 items, spend your Robux, or sell your account.

Normal players never need mshta. If someone sends you a command with mshta in it, that alone tells you it is a scam.

Example: the fake "Delta check"

One version going around right now uses the popular Delta executor as an excuse. The scammer accuses you of using Delta, or says you have to prove you don't have it before they will trade, give you a reward, or let you into a server. The "proof" is a command like this (link shortened on purpose, do not try to visit it):

No command can prove that you don't have an executor. The "check" is just the scammer's code being installed on your PC.

Delta is only one example. The same trick works with any story, and scammers switch it up all the time:

• "Prove you don't have an executor / exploit / cheat."
• "Run this to verify your account for the trade, giveaway, or middleman."
• "Run this to claim your free Robux, items, or reward."
• "Run this to get unbanned or to get the role in our server."
• "Run this to fix your lag, FPS, or a Roblox error."

The excuse changes, the link changes, the website name changes. The command is still a way to put their program on your PC.

How they get you to run it

• They tell you to press Windows + R, or open Command Prompt or PowerShell, paste the command, and press Enter.
• They say "nothing will happen if you're clean" or that a window will open and close quickly. That window is the program running.
• They put pressure on you: "do it now or we'll report you", "everyone in the server had to do it", "it only takes 5 seconds".
• They ask you to turn off your antivirus or ignore a Windows warning first.
• The link uses a domain that sounds official, often with words like "executor", "verify", "check", or a known program name in it.

The same goes for commands that start with powershell, cmd, or curl, or any command that contains a link. Never run them when a stranger sends them to you.

Someone asked you to run it? Block and report

The best thing you can do is not reply at all:

1. Don't run the command and don't open the link.
2. Block the person right away.
3. Report them on the platform where they contacted you (Discord, Roblox, TikTok, etc.). On Discord, report the message itself, so moderators can see the command.
4. Warn the moderators of the server where it happened. If it happened in the RBLXValue Discord server, open a ticket or tag a moderator so we can ban the account and warn others.

RBLXValue will never ask you to run a command, download a file, or paste anything into Windows + R, Command Prompt, or PowerShell. Verification on RBLXValue only happens through the website, the app, or our official Discord bot.

Already ran the command? Do this right away

Act fast. The sooner you do this, the more likely you keep your items.

1. Disconnect the infected PC from the internet (unplug the cable or turn off Wi-Fi).
2. On a different, clean device (for example your phone), change your Roblox password and use "Log out of all other sessions" in your Roblox security settings. This invalidates the stolen cookie.
3. Turn on 2-step verification for Roblox if it isn't on yet.
4. Change your Discord password on the clean device. This also resets your Discord token. Check for unknown devices under Settings > Devices and log them out.
5. Change the password of your email account, and any other passwords saved in your browser.
6. Run a full scan with Windows Security (and the Microsoft Defender Offline scan). If anything is found, or you are not sure, the safest option is to back up your personal files and reinstall Windows.
7. Check your Roblox trade history and transactions, and contact Roblox Support if items or Robux were taken.
8. Still block and report the person who sent it, so they can't do it to others.

Rule of thumb: if someone wants you to run mshta, or any other command, on your PC, it is a scam. Block them, report them, and move on.

Stay safe, and share this post with your friends and trading partners so they don't fall for it either.