Loading story…
Researchers reported overlapping malware campaigns that use fake or trojanized PDF reader packages to compromise Windows systems through DLL sideloading. Cisco Talos identified PXA Stealer targeting government and education organizations, while Beazley Security and SentinelLabs said the Python-based infostealer has operated at scale since late 2024, affecting more than 4,000 victims in 62 countries. The activity has been linked to Vietnamese-speaking threat actors who used phishing, signed software such as Haihaisoft PDF Reader and Microsoft Word 2013, and multi-stage loaders to evade detection and establish persistence through Windows Run registry keys.
The malware chains ultimately steal browser credentials, cookies, autofill data, cryptocurrency wallet contents, and other sensitive application data, with exfiltration routed through Telegram bots and Cloudflare Workers and ties observed to the Sherlock stolen-data marketplace. In a related development, Kroll said XWORM operators adopted a similar fake PDF reader delivery chain using Ghost Crypt, packaging a renamed Haihaisoft executable, a malicious DLL, and a decoy PDF in a ZIP archive. That infection path uses a "process hypnosis" technique to inject payloads into csc.exe, persists via rundll32.exe, and ends with a plugin-based RAT capable of information theft and ransomware-related actions.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
In July 2025 samples, researchers identified a Telegram bot token and chat ID used by PXA Stealer to exfiltrate stolen data through Cloudflare Worker relays. The same samples showed browser-targeting DLL injection against Edge, Chrome, Whale, and CocCoc.
Beazley Security and SentinelLabs observed the attackers evolve their infection chain in July 2025 to use a legitimate signed Microsoft Word 2013 executable with a sideloaded malicious msvcr100.dll. The archive also included hidden support files and a decoy document to disguise the attack.
Kroll reported that starting in July 2025, XWORM began using Ghost Crypt in a ZIP-based delivery chain that abused DLL sideloading in a fake HaiHaiSoft PDF Reader package. The bundled executable loaded a malicious local DLL when the victim opened the included PDF.
In an April 2025 wave, the actors used a signed copy of Haihaisoft PDF Reader with a malicious DLL to sideload malware. The chain established persistence via a Windows Registry Run key and retrieved additional payloads from Dropbox.
Beazley Security and SentinelLabs said the PXA Stealer campaign had been active since late 2024, with some Telegram bot IDs created as early as October 2024. Early waves delivered infostealers such as LummaC2 and Rhadamanthys before the actors shifted to updated Python-based payloads.
Kroll disclosed technical details on Ghost Crypt's process-hypnosis injection into csc.exe, Run-key persistence via rundll32.exe, and the final XWORM payload's configuration decryption and TCP C2 behavior. The report also linked Ghost Crypt to a service advertised on HackForums that supports multiple malware families.
Beazley Security and SentinelLabs described an ongoing infostealer operation attributed to Vietnamese-speaking actors and tied to a Telegram-based criminal marketplace. They reported more than 4,000 unique victims across 62 countries and detailed theft of browser, financial, and cryptocurrency data.
Cisco Talos published research on a new PXA Stealer campaign targeting government and education sectors for sensitive information. The reference establishes public reporting on the malware by mid-November 2024.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
kroll.com
Open sourcelabs.beazley.security
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Vietnamese-speaking cybercriminal operation is distributing the Python-based **PXA Stealer** through phishing ZIP archives disguised as documents. The archives use hidden and system file attributes to obscure their contents and include renamed, legitimately signed executables—including Microsoft Word 2013, `winword.exe`, Haihaisoft PDF Reader, and WinRAR—used to DLL-side-load malicious payloads. In one execution chain, a renamed Microsoft-signed `winword.exe` loads a malicious `AppvIsvSubsystems64.dll`, which reconstructs a subsequent command from a padded Korean-named document; a WinRAR binary masquerading as a PNG then extracts further components. The operators also stage a signed Python interpreter as `C:\Users\Public\Windows\svchost.exe` and use obfuscated Python code to hinder detection and sandbox analysis. PXA Stealer collects browser passwords, cookies, autofill and payment-card data, authentication tokens, cryptocurrency-wallet information, and other application data. Stolen data is routed through Cloudflare Workers and related intermediary infrastructure to Telegram bots and channels, supporting a broader Telegram-based criminal ecosystem associated with Sherlock-related services that resell and reuse compromised information. Researchers identified more than 4,000 victim IP addresses in 62 countries, with South Korea, the United States, the Netherlands, Hungary, and Austria among the most affected; Cloudflare was notified and disrupted reported malicious Worker infrastructure.
Sep 25, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026