Inside complex Adonis Hijacks

Adonis Hijacks are modified unofficial versions of Adonis released in the toolbox for malicious intent. Most of the Hijacks provide for the Hijackers in a group an Admin Panel and teleport the player to a Loading… place.

First Recognized Hijack [TELEPORT + PANEL]

This Hijacked Adonis version seems to run a require() snippet inside the dropper, as hijacked versions commonly do.

The require snippet inserted in a normal Adonis Dropper module, leads to a module that tries to scare away inspectors or moderation by linking to other modules.

The fake module/load er leads to three modules

1. UniverseSS ()
2. FlushedSS ()
3. Exopod GUI (FE Backdoor for members in the group)

Exopod Module

This was the easiest to analyze. This module gives specific members of a group the “Exopod” GUI.

Inside of this Exopod module, created by “buy_exopod” that has been moderated, there is another module; the teleportation module. This is an old common trick used by viruses to redirect uses to a place to get info about their game. It is usually done together with a backdoor GUI so that the hijackers can see populated games that have their backdoor.

Inside the Exopod GUI, there’s also a folder that could lead to game moderation. The script inside runs a “You just got vectored” something on x,y arguments using the Adonis’ Loadstring module inside.

UniverseSS and FlushedSS Modules

These two modules go in the shady zone. UniverseSS has been moderated. Meaning that it’s content has been deleted and replaced with the iconic red truss. Back to the Backdoor loader, it seems like it originally runned a :protecc() function on UniverseSS, it is unknown as to what it did.

The FlushedSS Module leads to a nasty plugin. I can’t check this one as Plugins can actually infect your PC and ruin your roblox games.

The Realization

Part of these codes still work, and that’s the problem. Most of these account and almost all of these cases covered by us had their creators already moderated! Roblox does not delete assets of deleted accounts, and that is the problem.