LofyStealer Targets Minecraft Players via Node.js Loader and Browser Injection

Gbhackers •Mayura Kathir • April 29, 2026

Minecraft players are being lured with a fake hacking tool called “Slinky” that secretly installs a powerful infostealer dubbed LofyStealer (also tracked as GrabBot), linked to the Brazilian cybercrime group LofyGang. The malware uses a Node. js-based loader and an in-memory C++ payload to steal browser data and exfiltrate it to a command-and-control (C2) server […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LofyStealer Malware Targets Minecraft Players with Node.js Loader A new infostealer malware named LofyStealer is targeting Minecraft players by masquerading as a cheat tool called 'Slinky.' This malware, linked to the Brazilian cybercrime group LofyGang, employs a Node.js-based loader and an in-memory C++ payload to conduct a two-stage attack. It stealthily extracts sensitive data from popular web browsers and sends it to a command-and-control (C2) server. The campaign is sophisticated, evading detection by standard security software. Victims are primarily gamers who unknowingly download the malicious tool. The attack's scope is concerning, given the popularity of Minecraft and the potential for widespread data theft. Currently, the malware is active and poses a significant risk to affected users. 3 sources 67

Extracted Entities

LofyStealer Targets Minecraft Players via Node.js Loader and Browser Injection

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)

Tools (1)