Bidirectional communication via polyrhythms and shuffles: Without Jon the beat must go on
Summary: Cisco Talos reported a new information-stealing campaign run by a Vietnamese-speaking threat actor targeting government and education entities in Europe and Asia, using PXA Stealer to harvest credentials for online accounts, VPN and FTP clients, financial data, browser cookies, and gaming software. PXA Stealer can decrypt the victim's browser master password and use it to steal stored credentials, and Talos released Snort rules and ClamAV signatures to detect it.
What's compelling: Harvested credentials let attackers log in directly, bypassing vulnerabilities and defensive architecture entirely - a pattern Talos Incident Response says it is seeing in an increasing number of engagements.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026