Cybersecurity threat hunters utilizing the ANY. The RUN interactive sandbox platform has uncovered an active infostealer campaign targeting the gaming community.
The malware, identified as LofyStealer and also tracked as GrabBot, disguises itself as a Minecraft hack named “Slinky”.
By using the official game icon, attackers trick young gamers into voluntarily executing the file. This campaign marks the return of the Brazilian cybercrime group LofyGang, highlighting a significant upgrade in their technical capabilities and operational structure.
Advanced Loader and Stealth Payload
The malware uses a highly evasive, two-stage, modular architecture. The first stage is a massive 53.5 MB loader file named load.exe.
This file is an entire Node.js runtime environment packaged into a standalone application.
By bundling the malicious JavaScript alongside thousands of legitimate system libraries, the attackers dilute malicious signatures and create a file too large for many automated security sandboxes to process.
During execution, the loader actively uses standard Windows networking libraries to establish connections with the attacker’s server.
Once the loader is running, it decrypts the second stage: a highly precise 1.4 MB native C++ payload called chromelevator.exe.
The loader injects this payload directly into system memory. To avoid triggering endpoint detection and response tools, the payload uses direct system calls to the Windows kernel, bypassing standard monitoring hooks.
The payload specifically targets eight different web browsers, including Chrome, Edge, Brave, and Firefox. It extracts five categories of sensitive information, such as cookies, saved passwords, authentication tokens, and financial data.
After gathering the data, the malware uses a hidden PowerShell command to compress the files into a ZIP archive. The archive is then secured using SHA-256 cryptography, encoded, and silently transmitted to the attacker’s server.
LofyGang Shifts To Malware-as-a-Service
This campaign highlights the professional evolution of LofyGang, a threat group active since 2021.
The group originally built its reputation by placing malicious code into open-source developer packages to steal Discord and streaming accounts. They have now transformed their operations into a full Malware-as-a-Service platform.
According to Zenox research, network analysis of the malware’s command-and-control server revealed a dedicated web panel hosted in a Brazilian data center. The server operates on port 8080 and presents a graphical dashboard branded as “LofyStealer V2.0”.
This platform allows multiple cybercriminal operators to monitor their victims in real time and generate custom executable files. The service is offered in both free and premium tiers, demonstrating a mature business model.
The LofyStealer campaign illustrates the growing danger facing the gaming community. Threat actors are increasingly utilizing enterprise-grade evasion techniques, such as memory injection and Node.js bundling, to attack unprotected personal computers.
Security defenders should monitor network traffic directed at the known server infrastructure and audit for unexpected Node.js or hidden PowerShell executions on endpoints.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
