tokens Archives

AppWizard

May 7, 2026

Power Simulator X codes May 2026

Power Simulator X codes provide players with opportunities for rerolls, allowing them to unlock new abilities and accumulate tokens. The current code "20KLIKES" grants 250 tokens and two aura rerolls. To redeem codes, players must launch the game, click the code button, enter the code, and hit enter. Codes are released by the game's developer to celebrate milestones. Expired codes include 10KLIKES, 5KLIKES, 1KLIKES, and LAUNCHDAY.

AppWizard

May 1, 2026

PC Users Can Claim 2 Free Games This Week, Save Over $100

The Epic Games Store offers free games weekly, with two titles available this week: Odsparks: An Automation Adventure and Firestone. Odsparks, developed by Massive Miniteam and published by HandyGames, is a cosy automation game released a year ago, typically priced at .99. It invites players to create automation workshops in a whimsical world. Firestone, a free-to-play idle clicker RPG from Holyday Studios launched in 2024, allows players to engage in battles and offers infinite progression offline. Claiming Firestone from the Epic Games Store this week provides worth of in-game bonuses, including various chests and resources. Both games are free until May 7 at 4 PM BST / 8 AM PT. Additionally, Hogwarts Legacy is available for free until May 3.

Tech Optimizer

May 1, 2026

Backstage Ditches Postgres for Databricks Lakebase

The divide between operational and analytical databases is diminishing, as evidenced by Databricks integrating Spotify's Backstage with its Lakebase, transitioning from PostgreSQL to a unified data platform. Lakebase now offers a serverless PostgreSQL interface within Databricks, allowing Backstage to operate without awareness of the underlying changes. The integration involved updating configurations and addressing authentication challenges using OAuth JWTs. The integration transforms the database development lifecycle by enabling near-instant database branching through Lakebase's copy-on-write architecture, allowing developers to focus on testing changes rather than safety. Branching creates a pointer to existing data, making the operation instantaneous. Point-in-Time Recovery (PITR) allows for quick restoration of data, demonstrated by a recovery process that took less than four seconds. The goal is to integrate database branching into developer workflows seamlessly, making it automatic. This change could enhance developer productivity by allowing live data testing from the start, eliminating the need for mock objects, and resolving common issues related to staging environments. The traditional constraints of slow and costly database copies will become obsolete, prompting teams to reconsider how much time they spend on workarounds for now-nonexistent constraints.

AppWizard

April 30, 2026

Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign

A Brazilian cybercriminal group known as LofyGang has re-emerged after three years, targeting Minecraft players with malware called LofyStealer, also known as GrabBot. This malware is disguised as a Minecraft hack named 'Slinky' and uses the official game icon to attract young users. The group has been active since late 2021 and previously leaked thousands of Minecraft accounts. The attack begins with the 'Slinky' hack, which deploys LofyStealer (identified as "chromelevator.exe") to harvest sensitive information from web browsers, including cookies, passwords, and credit card information, sending this data to a command-and-control server. ZenoX reports a shift in LofyGang's tactics from JavaScript supply chain attacks to a malware-as-a-service model, offering both free and premium tiers. Cybercriminals are increasingly exploiting trusted platforms like GitHub to distribute malware through bogus repositories and various deceptive tactics, including fake security alerts and counterfeit accounts. This trend highlights a strategy focused on volume targeting rather than precision, prompting cybersecurity experts to prioritize threats from GitHub-hosted downloads that appear legitimate.

AppWizard

April 30, 2026

LofyStealer Targets Minecraft Players via Node.js Loader and Browser Injection

Minecraft players are being targeted by a deceptive hacking tool called “Slinky,” which is actually an infostealer known as LofyStealer linked to the Brazilian cybercrime group LofyGang. The malware uses a Node.js-based loader and a C++ payload to extract sensitive browser data, disguising itself as a Minecraft hack. It primarily targets younger players who may unknowingly execute it. The malware operates through a two-stage architecture, with a 53.5 MB loader binary that injects a smaller 1.4 MB payload into browser processes, bypassing detection methods. It collects sensitive information such as cookies, passwords, and credit card details, compressing and encoding the data for exfiltration. The command-and-control (C2) infrastructure is hosted in Brazil, and the malware's design reflects advanced compilation techniques. The campaign is attributed to LofyGang, which has evolved into a more professional entity, posing severe risks to players who download cheats and cracked tools. Indicators of compromise include a specific C2 IP address and associated endpoints.

AppWizard

April 30, 2026

LofyStealer Uses Node.js Loader Against Minecraft Gamers

Cybersecurity threat hunters have discovered an active infostealer campaign targeting the gaming community, involving malware called LofyStealer (or GrabBot) that disguises itself as a Minecraft hack named “Slinky.” The attackers use the official game icon to trick young gamers into executing the malware. The Brazilian cybercrime group LofyGang has enhanced its technical capabilities, utilizing a sophisticated two-stage modular architecture. The initial stage features a 53.5 MB loader file named load.exe, which is a Node.js runtime environment that obscures malicious signatures. The loader connects to the attacker’s server and decrypts a 1.4 MB C++ payload, chromelevator.exe, which targets eight web browsers to extract sensitive information like cookies and passwords. The stolen data is compressed, encrypted, and sent to the attacker’s server. LofyGang has evolved into a Malware-as-a-Service platform, offering a web panel for operators to monitor victims and generate custom executables. The campaign highlights the increasing threats to the gaming community, with advanced evasion techniques being employed by cybercriminals. Security professionals are advised to monitor network traffic and conduct audits for suspicious activities.

Tech Optimizer

April 30, 2026

Inside the Architecture of an MCP Server for PostgreSQL

The Model Context Protocol (MCP) serves as a standard interface between large language models (LLMs) and external systems like PostgreSQL, emphasizing the importance of control over mere connectivity. An MCP server must act as a mediation and policy layer, enforcing security boundaries and ensuring that connections default to read-only. It should validate AI-generated SQL as untrusted input, encapsulate queries within transactions, and apply execution-time controls. The server must separate query generation from execution approval to manage operational costs and enforce guardrails on query types, such as limiting the number of rows returned. Token efficiency is crucial, with design considerations for compact data representation and schema introspection. In production, connection management is vital to prevent data leakage among multiple AI agents, and observability through logging executed queries and metadata is necessary for debugging and compliance. Long-running sessions require support for paginated responses to manage context effectively. Overall, the MCP server must integrate security, query safety, token efficiency, and observability into its design from the outset.

AppWizard

April 30, 2026

Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection

A new infostealer malware called LofyStealer is targeting the gaming community, particularly Minecraft players, by disguising itself as a cheat tool named “Slinky.” It employs a two-stage attack to extract sensitive information from eight major web browsers, including Chrome and Firefox, while evading detection by security software. The malware siphons off cookies, saved passwords, payment card information, and session tokens. Researchers at Zenox.ai identified LofyStealer, linking it to the Brazilian cybercrime group LofyGang, which has been active since October 2022. The malware uses social engineering tactics to appear legitimate and operates as a Malware-as-a-Service platform, offering both Free and Premium tiers to buyers. Its technical sophistication is evident in its method of in-memory browser injection, which allows it to bypass security defenses. The stolen data is compressed and sent to a command-and-control server. Users are advised to avoid downloading unofficial game mods and enable multi-factor authentication to reduce the risk of credential theft. Security teams should monitor for specific behavioral indicators related to the malware's operations.

Tech Optimizer

April 26, 2026

CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister

On April 21, 2026, compromised versions of pgserve (1.1.11, 1.1.12, and 1.1.13) were published on npm, containing a 1,143-line credential-harvesting script that executes during the postinstall phase of npm install. The malware functions as a supply-chain worm, reinjecting itself into other packages if it finds an npm publish token. Stolen credentials are encrypted using RSA-4096 and AES-256 and exfiltrated to a decentralized Internet Computer Protocol (ICP) canister. The last legitimate release was v1.1.10, published on April 17, 2026. The malware was detected by StepSecurity AI Package Analyst and Harden Runner, which flagged the compromised versions as Critical / Rejected and confirmed live exfiltration during analysis. The injected script performs operations such as harvesting environment variables, collecting filesystem secrets, encrypting payloads, and propagating to other npm packages and Python packages if a PyPI token is detected. The exfiltration domains have been added to a global block list.

AppWizard

April 21, 2026

Xbox PC Project Might Have Solved How To Fix Hundreds Of ‘Broken’ Windows Games

The Xbox Collection Tracker project on GitHub addresses connectivity issues faced by Windows 8-era games in the Xbox PC app due to the transition from XBL2.0 to XBL3.0 token formats. Microsoft has deprecated the old XBL2.0-formatted XSTS tokens, causing many older titles like Microsoft Mahjong, Minesweeper, Hydro Thunder Hurricane, and others to encounter sign-in errors and lose access to features tied to Xbox Live identity. The project aims to create a compatibility layer that allows these games to connect to Xbox servers using the modern XBL3.0 format without needing extensive modifications. Developers are advocating for a server-side translation layer to restore the functionality of these classic games while acknowledging potential security concerns.