# LofyGang returns with undicy-http typosquat delivering dual-payload RAT

> JFrog tied `undicy-http@2.0.0` (a typosquat of `undici`) to the Brazil-based LofyGang group last seen in 2022. The package pairs a Node.js WebSocket RAT with a native `chromelevator.exe` binary that uses direct syscalls for process hollowing, then injects browser credential stealers targeting 50+ browsers and 90+ wallet extensions.

- Published: 2026-03-31
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: npm
- Scope: 1 package, 1 compromised version
- Tags: typosquat, infostealer, crypto-wallet-drain, credential-theft
- Threat actor: LofyGang
- Also known as: GlassWorm-adjacent
- Detected by: JFrog
- Incident ID: npm-2026-03-31-undicy-lofygang

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [undicy-http](https://dependencywatch.io/package/npm/undicy-http) | npm | 2.0.0 |

## What happened

JFrog tied `undicy-http@2.0.0` - a typosquat of the popular `undici` HTTP client - to **LofyGang**, the Brazil-based crew first documented by Checkmarx in **October 2022**. The package author field reads `ConsoleLofy`, hardcoded strings include `Lofygang | t.me/lofygang`, and the logging is in Portuguese, all consistent with prior LofyGang tooling.

The campaign is a meaningful capability jump. Earlier LofyGang payloads were JavaScript-only stealers for Discord tokens and credit cards. This release pairs a Node.js WebSocket RAT (C2 `24.152.36.243:3000`) with a native `chromelevator.exe` binary that uses direct syscalls for process hollowing, then injects browser credential stealers covering **50+ browsers and 90+ wallet extensions** including 28+ desktop wallets and 6 hardware-wallet integrations.

- Native binary SHA-256: `d6090c843c58f183fb5ed3ab3f67c9d96186d1b30dfd9927b438ff6ffedee196`.
- Payload host: `amoboobs.com` (Cloudflare-fronted), last modified `2026-03-21`.
- Exfiltration channels: Discord webhooks, Telegram API, `gofile.io`, `catbox.moe`.
- Persistence: scheduled task `ScreenLiveClient` and Discord client trojanisation.

The binary matches YARA rule `MAL_Browser_Stealer_Dec25_2`, the same signature used to track the broader **GlassWorm** developer-targeting campaign across npm, PyPI and GitHub. Session hijack targets include Roblox, Instagram, Spotify, TikTok, Steam and Telegram - anyone with credentials on the host should treat them as compromised.

## Impact

- Browser credential and 28+ desktop wallet theft (incl. 6 hardware-wallet integrations)
- Session hijack across Roblox, Instagram, Spotify, TikTok, Steam, Telegram
- Syscall-level injection means full machine compromise once executed

## What to do

1. `npm uninstall undicy-http` and audit for the typosquat across CI/dev hosts
2. Delete scheduled task `ScreenLiveClient` and `chromelevator.exe`; reinstall Discord
3. Rotate all stored credentials; consider full re-image given syscall-level compromise
4. Block amoboobs.com and 24.152.36.243 at egress

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [LofyGang returns: a dual-payload npm package](https://research.jfrog.com/post/lofygang-returns-a-dual-payload-npm-package/) - JFrog
- [LofyGang: Software Supply Chain Attackers - Organized, Persistent, and Operating for Over a Year](https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over-a-year/) - Checkmarx

---

Canonical page: https://dependencywatch.io/incident/npm-2026-03-31-undicy-lofygang
Markdown version: https://dependencywatch.io/incident/npm-2026-03-31-undicy-lofygang.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).