A scammer contacts you (often on Discord) offering to make a free GFX (high-quality 3D render) of your avatar.
Once you send the file, they extract your login cookie. This allows them to bypass two-factor authentication (2FA) and log into your account instantly. How to Stay Safe Cookie logging explained - Developer Forum | Roblox roblox.har
Scammers often use social engineering to trick players into handing over this file: A scammer contacts you (often on Discord) offering
They claim they need your "avatar data" to import it into 3D software like Blender. click the Network tab
They send a video tutorial showing you how to go into your browser’s developer tools, click the Network tab, and "Save as HAR" .