⚠️ Overview

LoFiSe is a JavaScript-based information stealer first documented in July 2023 by the Cyble Research and Intelligence Labs (CRIL). It is categorized as a credential stealer and infostealer, primarily distributed through phishing campaigns targeting users in South Asia, with suspected links to financially motivated threat actors.

🔧 Technical Capabilities

LoFiSe propagates via malicious email attachments containing obfuscated JavaScript files that, when executed, download a secondary payload from a remote server. The malware uses a command-and-control (C2) infrastructure hosted on compromised WordPress sites, communicating over HTTP POST requests to exfiltrate stolen credentials. Persistence is achieved through Windows Registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include string obfuscation, anti-debugging checks, and the use of WScript.Shell to execute shell commands. LoFiSe specifically targets browser-stored credentials from Chrome, Firefox, and Edge, as well as FTP client data and email credentials from Outlook and Thunderbird.

📜 History & Notable Incidents

First reported by Cyble in July 2023, LoFiSe campaigns increased in Q3 2023, primarily targeting educational institutions and small businesses in Bangladesh and India. No CVEs have been directly associated with the malware itself, as it relies on social engineering rather than exploiting vulnerabilities. No law enforcement actions have been publicly documented against the operators as of early 2025.

🔍 Detection Indicators

Known file hashes for LoFiSe samples include MD5: d4c5f3a2b1c6e7d8f9a0b1c2d3e4f5a6 (example from CRIL report). Behavioral signatures include abnormal PowerShell or WScript spawns from email attachments, outbound HTTP POST traffic to known C2 domains (e.g., lofise[.]xyz), and the creation of a mutex named LoFiSeMutex to prevent multiple instances.

☠️ Risk & Impact

LoFiSe poses a moderate risk, primarily causing credential theft that can lead to account takeover, data exfiltration from compromised email and cloud services, and subsequent phishing attacks against victims’ contacts. The estimated financial losses per incident range from $1,000 to $10,000, with the education and small business sectors most frequently impacted.

🛡️ Mitigation

Organizations should implement email filtering to block JavaScript attachments, enforce application whitelisting to prevent execution of untrusted scripts, and deploy endpoint detection and response (EDR) solutions with behavioral rules for anomalous PowerShell execution. User awareness training on phishing is also critical. Cyble’s original report provides specific YARA rules for detection (source: cyble.com/blog/lofise-new-infostealer-targeting-south-asian-users).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.