LofyStealer

While LofyGang has previously leveraged the JavaScript supply chain as its initial attack vector, its latest campaign indicates a transition towards a malware-as-a-service model, said ZenoX researchers.

Stolen data is compressed using a hidden PowerShell command, encoded in Base64, and sent to the C2 server via an HTTP POST request

Intrusions commenced with the deployment of the Minecraft hack dubbed 'Slinky' ... to run a JavaScript loader that led to the injection of LofyStealer.

Rather than relying on common API functions that endpoint security products actively watch, it resolves low-level functions from ntdll.dll at runtime through direct syscalls.

Threat actors spread the malware entirely through social engineering. They package the malicious file as a Minecraft cheat called “Slinky” and use the game’s official icon to make it look completely legitimate.

The malware bundles a Node.js-based loader with a native C++ payload that is injected directly into live browser memory during execution.

MITRE ATT&CK Técnica Nome Evidência Binário T1055.003 Process Injection: Thread Execution Hijacking Criação de thread remota via syscall direta chromelevator

it queries the Windows registry to locate installed browsers and then launches the identified browser in a suspended state, temporarily halting the process before it becomes fully active. The loader then maps the payload directly into the browser’s memory space

The payload (chromelevator.exe) ... is decrypted in memory... MITRE ATT&CK Técnica Nome Evidência Binário T1027 Obfuscated Files or Information Payload criptografado, descriptografado em runtime chromelevator

Intrusions commenced with the deployment of the Minecraft hack dubbed 'Slinky', which utilized the official game icon for legitimacy, to run a JavaScript loader that led to the injection of LofyStealer.

The malware bundles a Node.js-based loader with a native C++ payload that is injected directly into live browser memory during execution.

MITRE ATT&CK Técnica Nome Evidência Binário T1055.003 Process Injection: Thread Execution Hijacking Criação de thread remota via syscall direta chromelevator

it queries the Windows registry to locate installed browsers and then launches the identified browser in a suspended state, temporarily halting the process before it becomes fully active. The loader then maps the payload directly into the browser’s memory space

It also includes anti-analysis mechanisms such as debugger detection and timing checks against sandboxes... MITRE ATT&CK Técnica Nome Evidência Binário T1497.003 Virtualization/Sandbox Evasion: Time Based Timing checks via GetTickCount/QPC chromelevator

The JavaScript loader is ultimately responsible for the deployment of LofyStealer ('chromelevator.exe') on compromised hosts and execute it directly in memory.

LofyStealer then proceeds to harvest and exfiltrate passwords, tokens, cookies, cards, and International Bank Account Numbers across several web browsers, including Google Chrome, Mozilla Firefox, Brave, and Microsoft Edge.

The malware covers a wide range of targets, hitting eight major browsers including Chrome, Edge, Brave, Opera GX, and Firefox, while extracting cookies, saved passwords, payment card details, active session tokens, and IBANs from each one.

Once injected and fully active inside the browser, the payload extracts cookies, stored passwords, session tokens, payment card data, and IBANs across eight targeted browsers.

MITRE ATT&CK Técnica Nome Evidência Binário T1555.003 Credentials from Web Browsers Extração de senhas armazenadas chromelevator

Once the loader, load.exe, runs on the victim machine, it queries the Windows registry to locate installed browsers

MITRE ATT&CK Técnica Nome Evidência Binário T1057 Process Discovery Detecção de processos de browser em execução load.exe

It also includes anti-analysis mechanisms such as debugger detection and timing checks against sandboxes. Finally, it performs system reconnaissance (hostname, time, environment variables)... MITRE ATT&CK Técnica Nome Evidência Binário T1082 System Information Discovery Coleta de hostname e fingerprint do host chromelevator

It also includes anti-analysis mechanisms such as debugger detection and timing checks against sandboxes... MITRE ATT&CK Técnica Nome Evidência Binário T1497.003 Virtualization/Sandbox Evasion: Time Based Timing checks via GetTickCount/QPC chromelevator

LofyStealer then proceeds to harvest and exfiltrate passwords, tokens, cookies, cards, and International Bank Account Numbers across several web browsers, including Google Chrome, Mozilla Firefox, Brave, and Microsoft Edge.

Stolen data is compressed using a hidden PowerShell command, encoded in Base64, and sent to the C2 server via an HTTP POST request

After collection, data is compressed using PowerShell in hidden mode... Generated files follow two naming patterns: .grab_<name>.zip and output_YYYYMMDD_HHMMSS.zip... MITRE ATT&CK Técnica Nome Evidência Binário T1560.001 Archive Collected Data: Archive via Utility Compressão ZIP dos dados roubados chromelevator

sent to the C2 server via an HTTP POST request with a SHA-256 integrity signature attached

WinHTTP is the Windows client HTTP library, used here for all communication with the C2 server... WinHttpOpen initializes the HTTP session with the User-Agent “GrabBot/1.0”... MITRE ATT&CK Técnica Nome Evidência Binário T1071.001 Application Layer Protocol: Web Protocols Comunicação C2 via HTTP/JSON ambos

Stolen data is compressed using a hidden PowerShell command, encoded in Base64, and sent to the C2 server via an HTTP POST request

After compression, the ZIP is Base64-encoded and sent to the C2 as part of a JSON payload... MITRE ATT&CK Técnica Nome Evidência Binário T1132.001 Data Encoding: Standard Encoding Codificação Base64 do ZIP para exfiltração chromelevator

LofyStealer then proceeds to harvest and exfiltrate passwords, tokens, cookies, cards, and International Bank Account Numbers across several web browsers.

sent to the C2 server via an HTTP POST request with a SHA-256 integrity signature attached

Flag Propósito ... –kill Mata processos de browser antes da injeção... MITRE ATT&CK Técnica Nome Evidência Binário T1562.001 Impair Defenses: Disable or Modify Tools Terminação de processos de browser (–kill) chromelevator