New malicious campaign hunts Discord messenger users via infected open-source packages

On July 26, using the internal automated system for monitoring open-source repositories, Kaspersky researchers identified a malicious campaign dubbed LofyLife. The campaign employed 4 malicious packages spreading Volt Stealer and Lofy Stealer malware in the open-source npm repository to gather various information from victims, including Discord tokens and credit card information, and to spy on them over time.

The npm repository is a public collection of open-source code packages widely used in front-end web apps, mobile apps, robots and routers, and also to serve countless needs of the JavaScript community. Its popularity makes the LofyLife campaign even more dangerous, as it could potentially have affected numerous users of the repository.

The identified malicious repositories appeared to be packages used for ordinary tasks such as formatting headlines or certain gaming functions, however they contained highly obfuscated malicious JavaScript and Python code. This made them harder to analyze when being uploaded to the repository. The malicious payload consisted of malware written in Python dubbed Volt Stealer, and a JavaScript malware dubbed Lofy Stealer, which possesses numerous features.

Volt Stealer was used to steal Discord tokens from the infected machines along with the victim’s IP address, and upload them via HTTP. The Lofy Stealer, a new development from the attackers, is able to infect Discord client files and monitor the victim’s actions – detecting when a user logs in, changes email or password details, enables or disables multi-factor authentication and adds new payment methods, including full credit card details. Collected information is also uploaded to the remote endpoint.

“Developers rely heavily on open-source code repositories – they use them to make IT-solution developments faster and more efficient, and significantly contribute to the development of the IT industry as a whole. As the LofyLife campaign shows, however, even reputable repositories cannot be trusted by default – all code, including open-source code, that a developer injects into his products becomes their own responsibility. We’ve added detections of this malware to our products, so users who run our solutions will be able to identify whether they have been infected and remove the malware,” comments Leonid Bezvershenko, security researcher at Kaspersky’s Global Research and Analysis Team.

Kaspersky products detect LofyLife malware as Trojan.Python.Lofy.a, Trojan.Script.Lofy.gen.