You no longer need technical skills to steal a child’s Roblox account. You need a Discord login and a few clicks. That is the uncomfortable takeaway from research NordVPN published on ready-made phishing tools aimed at young players.
Over seven days ending July 29, 2026, NordVPN’s threat intelligence team identified 196 active phishing addresses. They tested nearly 4,000 web address combinations and manually reviewed 24 suspicious sites. Twenty-two were confirmed fake Roblox pages. That is a small sample, so treat the hit rate as a rough signal, not a measured rate for the whole ecosystem.
Phishing as a service
The tools work like website builders. A scammer signs in through Discord or Telegram, generates a fake Roblox page, and shares the link. The service handles design, hosting and collection of stolen credentials. Some also mask suspicious links and supply backup domains and instructions.
One platform claimed more than 6 million stolen login records and over 239,000 registered users. Those numbers come from the service itself, so be skeptical. Still, researchers watched its displayed user count rise by 547 in just over 42 hours, which suggests real activity.
A separate provider supplies infrastructure that hides where the fake sites are hosted, making takedowns harder. Two scam sites showed a “Subscription expired” message from that provider. Somebody was paying for this.
How the lures work
The bait is mundane: a link to a new game, a rare item, or a player profile, sent through Discord, Roblox chat, YouTube or TikTok. Researchers found fake pages copying real profiles and game listings, including descriptions and play counts for titles like Blox Fruits and Grow a Garden. They also found pages impersonating RoVer, a tool that links Roblox and Discord accounts.
Domains add to the trick. A address like roblox.com.ug looks plausible at a glance but is an unrelated domain. Some phishing pages use HTTPS too. That only means the connection is encrypted, not that the site is honest. Many parents (and plenty of adults) still read the padlock as a trust badge.
Two-factor authentication is not a full shield
Some fake pages ask for the six-digit code or backup code right after the password. The scammer relays it to the real site and gets in. Malware hidden in unofficial tools, such as game enhancers, can also steal session data, which bypasses both password and 2FA.
So keep 2FA on, but understand its limit. Children should enter codes only on the official site or app, and never because a link or another player asked.
What parents can do
The advice is basic but sound: open Roblox directly, ignore free Robux offers, never share passwords or codes, and skip cheat tools. Tell kids they can report a bad click without punishment. If details were shared, change the password immediately.
NordVPN also recommends its own Link Checker and antivirus. Those may help, but they are product pitches from the researcher, so weigh them accordingly. The bigger point is structural. When phishing kits are cheap, subscription-based and easy to run, platforms with young users carry a constant risk, and education at home is doing work that platform defenses are not.