LofyGang's LofyStealer: A New Threat to Minecraft Players in 2026
In April 2026, the Brazilian cybercrime group LofyGang re-emerged after a three-year hiatus, launching a campaign targeting Minecraft players with a new malware known as LofyStealer. Disguised as a Minecraft hack named 'Slinky,' the malware uses the official game icon to deceive users into execution. Once activated, it deploys a JavaScript loader that installs LofyStealer ('chromelevator.exe') directly into the system memory. This stealer harvests sensitive data—including cookies, passwords, tokens, credit card information, and International Bank Account Numbers (IBANs)—from various web browsers such as Google Chrome, Microsoft Edge, Brave, Opera, Mozilla Firefox, and Avast Browser. The exfiltrated data is then transmitted to a command-and-control server controlled by the attackers. This incident underscores a significant shift in LofyGang's tactics from previous methods like typosquatting on npm packages to a malware-as-a-service (MaaS) model, offering both free and premium tiers. The campaign highlights the persistent threat posed by cybercriminals exploiting trusted platforms and popular games to distribute malicious software, emphasizing the need for heightened vigilance among users and robust security measures to protect sensitive information.
Kill Chain
