LofyGang is a Brazilian-origin cybercriminal group that emerged in 2020, primarily focused on financially motivated cybercrime through software supply chain attacks and credential theft. The group is distinguished by its extensive abuse of open-source package managers, particularly NPM, to distribute malicious packages. Initially known for JavaScript-based payloads targeting Discord tokens and credit card information, LofyGang has evolved to deploy more capable native Windows binaries incorporating direct syscall-level process injection and full-featured Remote Access Trojans. They are assessed with high confidence to be of Brazilian origin due to the prevalent use of Brazilian Portuguese in their malware and communications. LofyGang operates under various aliases, including DyPolarLofy and PolarLofy, and was also referred to as LofyLife by Kaspersky. Their primary motivation is financial gain through the theft and monetization of sensitive data, including credit card details, gaming a