CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

LofyGang Returns with Minecraft-Themed LofyStealer Campaign Targeting Gamers

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The Brazilian cybercrime group LofyGang has re-emerged after a three-year hiatus with a targeted campaign against Minecraft players using a new infostealer named LofyStealer (also tracked as GrabBot). The campaign leverages a trojanized Minecraft hack tool called 'Slinky' to deliver the stealer, which masquerades as the official game’s icon to deceive victims, particularly young users familiar with the gaming ecosystem. Once executed, LofyStealer (chromelevator.exe) is deployed in memory and harvests sensitive data from multiple browsers, including stored passwords, cookies, tokens, credit card details, and International Bank Account Numbers (IBANs). The exfiltrated data is sent to a command-and-control (C2) server located at 24.152.36[.]241. The group’s tactics have evolved to include a malware-as-a-service (MaaS) model with free and premium tiers, alongside a custom builder (Slinky Cracked) for payload delivery. This shift marks a significant departure from their historical focus on JavaScript supply chain attacks, such as npm package typosquatting and dependency hijacking, which previously targeted Discord tokens and gaming-related credentials.

Timeline

  1. 28.04.2026 20:39 1 articles · 2h ago

    LofyStealer Campaign Targets Minecraft Players via Trojanized 'Slinky' Hack Tool

    LofyGang has resumed operations after a three-year hiatus with a campaign distributing LofyStealer (chromelevator.exe) to Minecraft players. The attack begins with a trojanized Minecraft hack tool named 'Slinky,' which uses the official game’s icon to deceive victims. Upon execution, a JavaScript loader delivers the stealer payload in memory, harvesting sensitive data from multiple browsers. The malware exfiltrates collected data to a C2 server at 24.152.36[.]241. The campaign introduces a MaaS model with free and premium tiers and a custom builder (Slinky Cracked) for payload delivery.

    Show sources
    Open in new tab

Information Snippets