BUSINESS REPORTER
Kaspersky researchers using the internal automated system for monitoring open-source repositories have identified a malicious campaign dubbed LofyLife.
The campaign employs four malicious packages spreading Volt Stealer and Lofy Stealer malware in the open-source npm repository to gather various information from victims, including Discord tokens and credit card information, and to spy on them over time.
The npm repository is a public collection of open-source code packages widely used in front-end web apps, mobile apps, robots and routers, and also to serve countless needs of the JavaScript community.
Its popularity makes the LofyLife campaign even more dangerous, as it could potentially have affected numerous users of the repository.
The identified malicious repositories appeared to be packages used for ordinary tasks such as formatting headlines or certain gaming functions, however they contained highly obfuscated malicious JavaScript and Python code. This made them harder to analyse when being uploaded to the repository.
The malicious payload consisted of malware written in Python dubbed Volt Stealer, and a JavaScript malware dubbed Lofy Stealer, which possesses numerous features.
Volt Stealer was used to steal Discord tokens from the infected machines along with the victim’s IP address, and upload them via HTTP. The Lofy Stealer, a new development from the attackers, is able to infect Discord client files and monitor the victim’s actions – detecting when a user logs in, changes email or password details, enables or disables multi-factor authentication and adds new payment methods, including full credit card details.
Collected information is also uploaded to the remote endpoint.
