Minecraft players are being lured with a fake hacking tool called “Slinky” that secretly installs a powerful infostealer dubbed LofyStealer (also tracked as GrabBot), linked to the Brazilian cybercrime group LofyGang.
The malware uses a Node. js-based loader and an in-memory C++ payload to steal browser data and exfiltrate it to a command-and-control (C2) server hosted in Brazil.
The malicious file is promoted as a Minecraft “hack” named Slinky, complete with the official game icon to convince mostly young players to run it voluntarily. Once executed, the fake cheat quietly deploys LofyStealer instead of delivering any real in-game advantage.
Threat hunters first spotted the campaign in public submissions on the ANY.RUN sandbox, where suspicious binaries and network connections to 24.152.36.241:8080 exposed an active C2 infrastructure.
The infostealer follows a modular, two-stage architecture designed for stealth and flexibility. First, a large 53.5 MB loader binary called load.exe is executed; it is a Node.js application packaged with the “pkg” tool, bundling the full V8 engine, OpenSSL, and other libraries to blend in as a legitimate runtime and evade signature-based detection.
This loader then decrypts and injects a much smaller 1.4 MB native C++ payload named chromelevator.exe directly into browser processes, using direct syscalls instead of standard Windows APIs to bypass common EDR hooks.
Once injected into browsers such as Chrome, Edge, Brave, Opera, Opera GX, Firefox, and Avast Secure Browser, the payload operates fully in memory to reduce forensic traces on disk.
It systematically targets sensitive data including cookies, saved passwords, session tokens, credit card information, and even International Bank Account Numbers (IBANs) stored by the victim’s browsers.
Collected data is organized, compressed into ZIP archives, Base64-encoded, and prepared for exfiltration through a structured JSON format.
The 53.5 MB binary contains the complete Node.js runtime (Google’s V8 engine, libuv for async I/O, OpenSSL for cryptography, zlib for compression, ICU for internationalization, llhttp for HTTP parsing) plus the malicious JavaScript code.
The panel exposes features such as victim monitoring, account management, campaign overview, and a builder used to generate new malicious executables, confirming a Malware-as-a-Service (MaaS) model.
All stolen information is sent via HTTP POST requests to the C2 server at 24.152.36.241 on port 8080, which also hosts a web-based management panel branded “LofyStealer, Advanced C2 Platform V2.0.”
The C2 runs on infrastructure operated by a Brazilian hosting provider, aligning with previous reports that LofyGang is a Brazil-based group.
The .text section occupies 98.4% of the total file with an entropy of 7.84, which is extremely high. This entropy indicates compilation with LTCG (Link-Time Code Generation) combined with possible inline encrypted data, such as the injection payload and decryption keys.
The move from poisoned npm packages to a polished Minecraft-focused MaaS platform shows the group’s evolution toward more professional, multi-operator operations.
Researchers attribute this campaign to LofyGang with high confidence, citing the “LofyStealer” branding, Brazilian hosting, Portuguese-language artifacts, and the group’s long-standing interest in stealing Discord, gaming, and streaming accounts.
For Minecraft players, especially teens downloading cheats and cracked tools, this means a single “hack” download can now lead to complete compromise of browser-stored credentials and financial data across multiple services.
| Indicador | Valor |
| IP do C2 | 24.152.36.241 |
| Endpoint de upload | /upload (HTTP POST) |
| Endpoint de tempo | /time (HTTP GET) |
| User-Agent | GrabBot/1.0 |
| Content-Type | application/json |
| Protocolo fallback | WebSocket |
| Painel C2 | http://24.152.36.241:8080 (LofyStealer V2.0) |
| Nome da plataforma | LofyStealer -Advanced C2 Platform V2.0 |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…