The Brazilian cybercriminal group LofyGang has returned to activity after three years of silence. Their new campaign, dubbed LofyStealer or GrabBot, targets Minecraft players. The malware disguises itself as a hack called Slinky and uses the official game icon to trick users. The cybersecurity firm ZenoX has published a technical report detailing the operation.
How the malware hiding behind a fake mod operates 🎮
LofyStealer is distributed as an executable file that mimics the appearance of a mod or hack for Minecraft. When executed, the malware displays a fake interface that requests credentials for a Microsoft account or third-party services. In the background, it extracts cookies, session tokens, and browser data. The infection spreads through links on Discord and GitHub repositories that promise game enhancements. ZenoX notes that the code includes obfuscation techniques to evade antivirus detection.
Brazilian hackers gift players an unwanted bonus 🎁
Because nothing says good move like downloading a Minecraft hack that promises advantages and ends up giving away your accounts to a group of cybercriminals. LofyGang has returned with the same old strategy: deceiving those looking for shortcuts. If you see a mod called Slinky with the Minecraft logo, think twice. Perhaps the real mod is the one that steals your data, and the bonus, losing access to your favorite server.