LofyStealer: Malware targeting Minecraft players.

A sophisticated two-stage infostealer named LofyStealer, also known as GrabBot/Slinky, targets Minecraft players through social engineering. The malware comprises a 53.5MB Node.js-based loader disguised within legitimate libraries and a 1.4MB native C++ payload that executes directly in memory. It extracts cookies, passwords, tokens, credit cards, and IBANs from eight different browsers including Chrome, Edge, Brave, Opera GX, and Firefox. The loader uses GitHub Actions for automated compilation while the payload employs direct syscalls to bypass EDR detection. Data is compressed via PowerShell, Base64-encoded, and exfiltrated to a Brazilian-hosted C2 server at 24.152.36.241. The operation is attributed with high confidence to the Brazilian cybercrime group LofyGang, operating a Malware-as-a-Service platform with Free and Premium tiers through a web panel branded as LofyStealer Advanced C2 Platform V2.0.

• Aoki: Infostealer Targets AI Coding Assistant CredentialsMalware2026-10-15
• LiteLLM supply chain compromiseCampaign2026-10-22
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• September 2026 Infostealer Trend ReportMalware2026-10-28