LofyGang
LofyGang is a Brazilian-origin cybercrime threat group publicly tracked since 2022 for software supply-chain abuse and credential theft. Reporting links the group to Brazilian Portuguese-language artifacts, aliases such as ConsoleLofy and DyPolarLofy, and repeated use of npm packages to distribute malware. The group was first documented by Checkmarx and Sonatype in 2022 as a Brazilian Portuguese-speaking operation abusing npm, including typosquatted and malicious packages. Checkmarx linked nearly 200 malicious npm packages to LofyGang and reported that the campaign persisted for more than a year. Those packages were used to infect downstream applications and steal end-user payment card data and credentials, including Discord Nitro, gaming, and streaming-service accounts. Reporting also states the group traded stolen credit cards and streaming-service credentials via a Discord forum and developed or distributed in-house hacking tools on GitHub. More recent reporting attributes additional npm activity in 2026 to LofyGang, including packages such as undicy-http and separadordeinfocc published by the npm maintainer consolelofy. JFrog attributed this activity to LofyGang based on the author name, hardcoded strings such as "Lofygang Started," and Portuguese-language code artifacts. The packages delivered a Node.js remote access trojan and a native Windows stealer, including chromelevator.exe, with capabilities including persistence, anti-analysis checks, remote shell execution, screen streaming, webcam and microphone access, and theft of browser credentials, cookies, session tokens, payment card data, IBANs, Discord tokens, and cryptocurrency wallet data. Reporting states exfiltration occurred through Discord webhooks and a Telegram bot. LofyGang has also been linked with a campaign targeting Minecraft players using LofyStealer, also known as GrabBot. ZenoX attributed this activity with high confidence to LofyGang and described it as a Brazilian-origin cybercrime operation. In this campaign, the malware was disguised as a fake Minecraft hack named Slinky using the official Minecraft icon as a lure. The infection chain used a JavaScript loader to deploy the stealer, which harvested passwords, tokens, cookies, payment card data, and IBANs from multiple browsers including Chrome, Firefox, Brave, Edge, Opera, Opera GX, Chrome Beta, and Avast Browser. Reporting describes this campaign as a shift from the group’s earlier JavaScript supply-chain tradecraft toward a malware-as-a-service model with free and premium tiers and a builder called Slinky Cracked. Across reporting, LofyGang is consistently described as a financially motivated cybercrime group focused on credential theft, payment data theft, browser and Discord token theft, and malware distribution through npm and social-engineering lures. Known aliases and related names directly mentioned in reporting include LofyGang, ConsoleLofy, and DyPolarLofy. Malware and tooling directly associated in the reporting include LofyStealer/GrabBot, NYX, chromelevator.exe, and the Slinky lure.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Financial Services
Where they're from
Attributed origin per open-source reporting.
- BR
Tradecraft
40 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Observables
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Compromising Minecraft players using the Slinky hack as a lure to deploy a JavaScript loader and inject the LofyStealer information-stealing malware; the campaign suggests a shift toward a malware-as-a-service model.
Brazilian-origin cybercrime group linked to the LofyStealer MaaS operation, distributing malware disguised as a Minecraft cheat ('Slinky') to steal browser cookies, passwords, payment card data, session tokens, and IBANs from victims.
Brazilian-origin cybercrime group targeting Minecraft players and gaming users, distributing stealer malware via fake Minecraft hacks and previously via npm typosquatting. The group steals browser data, Discord-related accounts and payment data, and appears to be shifting toward a malware-as-a-service model.
Software supply chain campaign using a malicious npm package (undicy-http) to compromise Node.js developers, deploy a Node.js RAT and a browser-stealing native payload, steal credentials/session data/cryptocurrency wallet data, and provide live remote access to victim systems.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.