Loading story…
Researchers reported that Panda Stealer is being distributed through spam emails carrying malicious Excel attachments and is designed to steal cryptocurrency wallet data, browser information, screenshots, and credentials from applications including NordVPN, Telegram, Discord, and Steam. The malware was described as a modified fork of Collector Stealer and was observed targeting victims in the United States, Australia, Japan, and Germany during a broad spam wave.
The malware uses fileless and evasive techniques to avoid detection, including PowerShell, payload hosting on paste.ee, in-memory loading of a .NET assembly, and process hollowing of MSBuild.exe. Investigators also linked the operation to multiple command-and-control and download servers, and said testing activity suggested use of a Shock Hosting VPS and Cassandra Crypter, indicating a coordinated credential- and wallet-theft campaign focused on monetizing stolen crypto assets and account access.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro observed Panda Stealer being delivered through spam emails in early April 2021. The malware was identified as an information stealer targeting cryptocurrency wallets and other credentials.
Trend Micro disclosed technical details on Panda Stealer, including its fileless Excel and PowerShell infection chains, in-memory .NET loading, process hollowing of MSBuild.exe, and links to more than 140 C2 servers and over 10 download sites. The report also noted affected countries and similarities to Collector Stealer.
Shock Hosting confirmed that the server assigned to an IP address believed by researchers to have been used by the Panda Stealer actor for testing had been suspended. The IP was linked to an active Panda Stealer C2 server during the investigation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tracked **Panda Banker**—also known as **PandaZeuS**, a Zeus-derived banking trojan—across multiple campaigns that used phishing, malvertising, and exploit-kit delivery to infect Windows users and steal credentials through **man-in-the-browser** webinjects. Reports documented active variants from `2.6.1` through `2.6.10`, including a Japanese campaign built around version `2.6.6` with 27 webinjects aimed largely at local banks and credit-card sites, as well as botnets and configs labeled **ank**, **Onore2**, **Cosmos3**, and `2.6.8`. Operators also altered Panda’s configuration encryption, apparently to hinder malware extractors and obscure controller infrastructure. Technical analyses showed Panda using staged JavaScript webinjects, backend-driven fraud workflows, screenshots, keylogging, clipboard theft, and VNC-related abuse to capture credentials and manipulate online banking sessions. The malware’s second-stage logic could identify login pages, exfiltrate victim data over HTTPS, display fake outage overlays, and guide victims into authorizing fraudulent transfers, effectively bypassing two-factor authentication through social engineering. By 2018, Panda had broadened beyond traditional financial targets to **cryptocurrency exchanges**, social media, email, ecommerce, entertainment, search, tech, and adult sites, while exposed administration panels and public config tracking highlighted a mature criminal operation with region-specific infrastructure tied to campaigns in Italy, Japan, the United States, and Latin America.
Aug 15, 2026
A Vietnamese-speaking cybercriminal operation is distributing the Python-based **PXA Stealer** through phishing ZIP archives disguised as documents. The archives use hidden and system file attributes to obscure their contents and include renamed, legitimately signed executables—including Microsoft Word 2013, `winword.exe`, Haihaisoft PDF Reader, and WinRAR—used to DLL-side-load malicious payloads. In one execution chain, a renamed Microsoft-signed `winword.exe` loads a malicious `AppvIsvSubsystems64.dll`, which reconstructs a subsequent command from a padded Korean-named document; a WinRAR binary masquerading as a PNG then extracts further components. The operators also stage a signed Python interpreter as `C:\Users\Public\Windows\svchost.exe` and use obfuscated Python code to hinder detection and sandbox analysis. PXA Stealer collects browser passwords, cookies, autofill and payment-card data, authentication tokens, cryptocurrency-wallet information, and other application data. Stolen data is routed through Cloudflare Workers and related intermediary infrastructure to Telegram bots and channels, supporting a broader Telegram-based criminal ecosystem associated with Sherlock-related services that resell and reuse compromised information. Researchers identified more than 4,000 victim IP addresses in 62 countries, with South Korea, the United States, the Netherlands, Hungary, and Austria among the most affected; Cloudflare was notified and disrupted reported malicious Worker infrastructure.
Sep 25, 2026
Researchers detailed **Vanta Stealer**, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with **PyInstaller** and obscured with multiple **PyArmor** layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images. After harvesting data, Vanta Stealer logs the results in `Summary.txt`, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Aug 6, 2026