Hackers used fake Roblox “game enhancements” to steal login details from hundreds of thousands of players, then sold the accounts for profit.