PXA StealerMalware
- pxastealer
PXA Stealer is an information-stealing malware written in Python, identified by Cisco Talos in an active campaign attributed to a Vietnamese-speaking threat actor (2024). The stealer targets sensitive data such as credentials for online accounts, VPN and FTP clients, financial information, browser cookies, and gaming-related data.From MISP Galaxy
Last reported 18 days ago, by The Hacker News2 reports
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1027.009Embedded Payloads
“…ng and URL shortening service”, this stage is much larger than the previous Python script (40KB -> ~3 MB), as it contains two more embedded payloads.”
- T1055.012Process Hollowing
“T1055.012”
- T1056.001Keylogging
“These plugins could add functionality for anything from microphone/webcam access to real-time keylogging and hidden desktop access.”
- T1059.006Python
“T1059.006”
- T1071.001Web Protocols
“T1071.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes“According to a report published by Mimecast in July 2026, malware families like VietCredCare, DuckTail, NodeStealer, and PXA Stealer have engendered ad account theft at scale, leading to a "widespread commodity crime in the advertising ecosystem" where bad actors drain business b…”
-
A Vietnamese threat actor's shift from PXA Stealer to PureRAT“A Vietnamese threat actor's shift from PXA Stealer to PureRAT”
Indicators in its reports
named in the reports above- 157.66.26[.]209in 1 report
- 06fc70aa08756a75…9ed4a823fd9din 1 report
- f5e9e24886ec4c60…cdb650dd2601in 1 report
- f6ed084aaa8ecf1b…1fc4be1bd709in 1 report
- hxxps://0x0[.]st/8WBr.pyin 1 report
- 0x0[.]stin 1 report
- hxxps://is[.]gd/s5xknuj2in 1 report
- hxxps://paste[.]rs/fVmzSin 1 report
- museads[.]aiin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.