New PXA Stealer targets government and education sectors for sensitive information
Summary: Cisco Talos reports that an actor it assesses to be Vietnamese is distributing PXA Stealer, a Python infostealer, through phishing emails with ZIP attachments containing a Rust loader and obfuscated batch scripts, targeting education organizations in India and government bodies in Sweden and Denmark. The stealer kills endpoint detection, VPN, wallet and browser processes, decrypts Chrome and Firefox master keys to harvest credentials, cookies, credit card and autofill data, and exfiltrates it through attacker-controlled Telegram bot tokens and chat IDs.
What you should know: The payload was hosted on tvdseo[.]com, a domain belonging to a legitimate Vietnamese SEO provider, and the actor's Telegram profile links to a private antivirus checker that lets buyers test detection rates before purchase - a supply chain and pre-sales pipeline that your endpoint controls may never see.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026