Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign
ID: 1d91de38-2c4d-53db-97d4-cde3ac128704
STIX ID: report--1d91de38-2c4d-53db-97d4-cde3ac128704
Feed Name: The Hacker News
ZenoX attributes a renewed campaign to LofyGang distributing LofyStealer/GrabBot via a fake Minecraft 'Slinky' hack and a builder called Slinky Cracked; the JavaScript loader drops an in-memory stealer (chromelevator.exe) that harvests browser cookies, passwords, tokens, payment cards and IBANs and exfiltrates them to C2 24.152.36.241. The report highlights the actor's historical supply-chain and GitHub abuse (npm typosquatting, starjacking, repo lures), and notes a shift toward a MaaS model offering free/premium tiers and a bespoke builder to scale victimization of gaming communities.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.