LofyStealer (also known as GrabBot or Slinky) is a sophisticated infostealer malware targeting Minecraft players by leveraging social engineering. It consists of a 53.5MB Node.js-based loader disguised within legitimate libraries and a 1.4MB native C++ payload that executes directly in memory to avoid detection. The malware extracts sensitive information including cookies, passwords, tokens, credit cards, and IBANs from eight browsers: Chrome, Edge, Brave, Opera GX, and Firefox among them. The loader uses GitHub Actions for automated compilation, while the payload uses direct syscalls to evade EDR detection. Data exfiltration is performed by compressing the stolen data via PowerShell, encoding it in Base64, and sending it to a Brazilian-hosted C2 server at IP 24.152.36.241. The operation is attributed with high confidence to the Brazilian cybercrime group LofyGang, which offers this malware as a service with Free and Premium tiers through a branded web panel called LofyStealer Advanced C2 Platform V2.0.

The malware compromises user privacy and security by stealing a wide range of sensitive information from multiple browsers, including authentication tokens, passwords, and financial data such as credit card numbers and IBANs. This can lead to account takeovers, financial fraud, and identity theft for affected users. The use of in-memory execution and syscall evasion techniques reduces the likelihood of detection by security tools, increasing the risk of successful compromise. The targeting of Minecraft players via social engineering suggests a focused attack vector on this user community.

No official patch or remediation is available as this is malware rather than a software vulnerability. Mitigation should focus on user education to recognize and avoid social engineering attempts targeting Minecraft players. Endpoint detection and response solutions should be updated to detect behaviors associated with in-memory execution and syscall evasion. Blocking network traffic to the identified C2 IP address (24.152.36.241) may help disrupt data exfiltration. Monitor for the provided file hashes and indicators of compromise to identify infections. Since this is a Malware-as-a-Service platform, organizations should also consider restricting execution of unauthorized Node.js and PowerShell scripts and applying least privilege principles to limit malware impact.