LofyStealer Targets Minecraft Players via Node.js Loader and Browser Injection
ID: efe200da-25a6-57ef-af4e-5a2236a4f7db
STIX ID: report--efe200da-25a6-57ef-af4e-5a2236a4f7db
Feed Name: GBHackers
Threat Score
**Executive summary:** A malicious campaign distributes a fake Minecraft "Slinky" cheat that deploys LofyStealer (GrabBot) via a large Node.js loader which injects an in-memory C++ payload into multiple browsers to steal cookies, saved passwords, session tokens, credit card data and IBANs, exfiltrating results to a Brazilian-hosted C2 (24.152.36.241:8080); the report includes technical analysis, IOCs, and ties the activity to the LofyGang MaaS platform.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.