PXA Stealer
PXA Stealer is a Python-based information stealer first observed in 2024 and widely reported through 2025. It is linked in multiple reports to Vietnamese-speaking threat actors or Vietnam-linked cybercriminal groups. The malware is designed to steal sensitive information from infected Windows systems, including login credentials, browser-stored passwords and cookies, autofill data, authentication tokens, financial information, credit card data, personally identifiable information, email client credentials, Discord and Telegram data, VPN and application data, and cryptocurrency wallet artifacts. Reported targeting includes browser data from Chromium- and Gecko-based browsers, desktop and browser-extension cryptocurrency wallets, and website-specific data from financial and cryptocurrency services such as Binance, Coinbase, Kraken, KuCoin, OKX, PayPal, Bybit, Gemini, Upbit, and Hyperliquid.
Observed delivery methods are primarily phishing and lure-based campaigns. Reported infection chains include ZIP archives, malicious links, phishing emails, LinkedIn recruiter lures, Google Forms and shortened URLs, Dropbox-hosted archives, and DLL sideloading using legitimate signed software such as Haihaisoft PDF Reader, Microsoft Word 2013, Adobe binaries, and renamed WinRAR executables. Several campaigns used malformed or disguised PDF/archive files, certutil for decoding embedded archives, renamed Python interpreters masquerading as svchost.exe or nsedge.exe, and heavily obfuscated Python scripts executed in memory. Persistence has been observed via Windows Registry Run keys and scheduled tasks masquerading as Microsoft Edge or Windows update activity.
The malware uses multiple anti-analysis and evasion techniques documented across reports, including layered obfuscation, oversized padded DLLs or scripts, junk data inflation, masquerading with trusted filenames, use of signed binaries and LOLBINs, and DLL sideloading. Some campaigns also included browser injection components to access Chrome App-Bound Encryption Keys.
Exfiltration is consistently reported through Telegram infrastructure, including Telegram bots and channels, sometimes relayed through Cloudflare Workers or dynamically resolved through Telegram pages and intermediary services. Additional payload retrieval from services such as paste[.]rs, 0x0[.]st, Dropbox, and attacker-controlled hosts was also reported. One large campaign was reported to have infected more than 4,000 unique victims across 62 countries, with heavily affected countries including South Korea, the United States, the Netherlands, Hungary, and Austria. Reported victim sectors include government, education, job seekers, and financial institutions.
High-confidence indicators directly mentioned in the content include Telegram bot identifiers such as ADN_2_NEW_VER_BOT, DA_NEW_VER_BOT, JAMES_NEW_VER_BOT, JND_NEW_VER_BOT, MR_P_NEW_VER_BOT, MR_Q_NEW_VER_BOT, KBL_NEW_VER_BOT, MRB_NEW_VER_BOT, and Verymuchxbot; Telegram bot token 7414494371:AAHsrQDkPrEVyz9z0RoiRS5fJKI-ihKJpzQ; Telegram chat ID -1002698513801; Cloudflare Worker domain lp2tpju9yrz2fklj.lone-none-1807.workers[.]dev; Telegram channel hxxps://t.me/erik22sucbot; infrastructure such as 151.243.109.125, mongky68[.]godohosting[.]com, downloadtheproject[.]xyz, paste[.]rs, and 0x0[.]st; and persistence artifacts including a Run key named Windows Update Service and a scheduled task named MicrosoftEdgeUpdateTaskMachine.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
7 techniques
Execution
In October 2025 and December 2025... established persistence via registry Run keys or scheduled tasks... CrystalPDF.exe establishes persistence via scheduled tasks.
Persistence (TA0003) Scheduled Task/Job: Scheduled Task (T1053.005) Scheduled task created for persistence across reboots
These campaigns leverage fileless execution, native macOS utilities, and AppleScript automation... Execution of various commands and scripts via osascript and sh.
Upon execution, the malicious DLL creates a .CMD script Evidence.cmd in the current directory, which orchestrates all subsequent steps in the attack chain... The sideloaded DLL then launches a hidden instance of Command Prompt and begins a multi-stage chain of activity.
This extracts several Python dependencies, including a legitimate Python 3.10 interpreter renamed svchost.exe and a malicious Python script named Photos... The Python interpreter is renamed to svchost.exe and launches a heavily obfuscated Python script again disguised as images.png.
Persistence
3 techniques
Persistence
In October 2025 and December 2025... established persistence via registry Run keys or scheduled tasks... CrystalPDF.exe establishes persistence via scheduled tasks.
Privilege Escalation
4 techniques
Privilege Escalation
In October 2025 and December 2025... established persistence via registry Run keys or scheduled tasks... CrystalPDF.exe establishes persistence via scheduled tasks.
Persistence (TA0003) Scheduled Task/Job: Scheduled Task (T1053.005) Scheduled task created for persistence across reboots
Stealth
9 techniques
Stealth
The final payload is an updated version of PXA Stealer... The Python interpreter is renamed to svchost.exe and launches a heavily obfuscated Python script again disguised as images.png... Once downloaded, the obfuscated Python code is decoded and executed.
Defense Evasion (TA0005) Obfuscated Files or Information: Binary Padding (T1027.001) DLL inflated to ~100 MB to bypass file size thresholds in automated scanners
The Microsoft Word 2013 binary is renamed to appear to the user as a Word document... a legitimate WinRar executable also hosted in the folder renamed images.png... a legitimate Python 3.10 interpreter renamed svchost.exe... files with familiar extensions, such as PNG and PDF, to conceal embedded WinRAR executables and ZIP archives.
Defense Evasion (TA0005) Masquerading: Match Legitimate Name or Location (T1036.005) Python executable renamed to nsedge.exe; files placed in a legitimate-looking Edge directory
The infostealer will also attempt to inject a DLL into running instances of browsers such as Chrome, targeting Chrome’s App-Bound Encryption Key to defeat the internal encryption schemes within Chrome.
Defense Evasion (TA0005) Indicator Removal: File Deletion (T1070.004) The archive and extraction utility deleted post-execution to reduce forensic artifacts.
To evade detection, we observed the use of... signed and living off the land binaries.
Credential Access
3 techniques
Credential Access
The stolen data includes... more than 4 million harvested browser cookies... The new variant of PXA Stealer will enumerate Chromium/Gecko browsers, decrypt any saved passwords, cookies... and any authentication tokens.
Discovery
1 technique
Discovery
Collection
1 technique
Collection
The collected data is packaged into ZIP archives then exfiltrated to a specific Telegram bot via Cloudflare Worker relays... Prior to transferring the exfiltrated data, the stealer packages stage data into an archive using the following naming convention where CC=Country Code: [CC_IPADDRESS]_HOSTNAME.zip
Command and Control
6 techniques
Command and Control
One of the payloads is a Python script that establishes communication with a remote server... Communication to command and control server.
Inspect network egress for POST requests to newly registered or suspicious domains... Exfiltration through curl.
Dropbox Used for Payload Staging T1102 – Web Service Trusted cloud platform abused as a payload host across campaigns
This component... retriev[es] additional malicious components, including Windows executable payloads hosted remotely on Dropbox... There are also conditions where the malware will reach out to external sources for additional Python payloads, such as 0x0[.]st... When retrieving files from paste[.]rs... constructs the full download URL hosting another payload.
Exfiltration
3 techniques
Exfiltration
collected sensitive information, and exfiltrated the data via Telegram... then send everything to attacker servers... Exfiltration through curl.
The final payload, PXA Stealer, exfiltrates... to Telegram channels via automated bot networks... The collected data is packaged into ZIP archives then exfiltrated to a specific Telegram bot via Cloudflare Worker relays... PXA Stealer transmits data via HTTP POST requests to the Telegram API.
IOCs tracked for this family
114 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Python-based infostealer that steals browser passwords, cookies, autofill data, authentication tokens, financial data, cryptocurrency wallet data, VPN/client/app data, and other sensitive information, then packages and exfiltrates it via Telegram, including through Cloudflare Worker relays. It also attempts browser DLL injection to access Chrome App-Bound Encryption Key material.
A Vietnam-linked multi-stage Python-based infostealer delivered via LinkedIn job lures. It uses DLL sideloading with a legitimate Microsoft Office binary, oversized padded DLLs, staged batch execution, persistence via scheduled tasks or registry, dynamic C2 retrieval through Telegram, and in-memory execution to steal browser credentials, cookies, crypto wallets, 2FA/authenticator data, desktop wallet data, Telegram Desktop sessions, Ledger Live artifacts, and email client credentials.
Information-stealing malware that harvests browser credentials, saved passwords, and cryptocurrency wallet data, establishes persistence via a registry entry, hooks browsers during active sessions, and exfiltrates stolen data through Telegram channels.
Associated Analytic Story ... PXA Stealer ...
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.