Loading story…
Vietnamese authorities in Thanh Hoa province charged 12 suspects linked to a global malware operation built around PXA Stealer, a Python-based infostealer that allegedly compromised more than 94,000 computers across Europe, the Americas, and Asia. Investigators said the malware campaign was technically led by a self-taught Vietnamese high school student identified only as Nguyen, who reportedly used the Telegram handle "Lone None" and helped develop tooling that harvested browser cookies, saved passwords, and autofill data from infected systems.
Police said the group distributed the malware through mass-email campaigns using executables disguised as PDFs and other routine documents, often packaged in compressed archives and sent with purchased email lists and automated bulk-delivery tools. Stolen data was reportedly exfiltrated through Telegram bots and supported by VPS-hosted infrastructure that also enabled remote access to victim machines; investigators linked the operation to the theft of more than 200,000 credentials and over 4 million browser cookies, and said suspects were charged under Vietnamese laws covering illegal tool production and unlawful access to computer networks and electronic devices.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A joint SentinelOne and Beazley Security investigation in mid-2025 traced the malware campaigns across 62 countries. The investigation linked the activity to theft of more than 200,000 credentials and collection of over 4 million browser cookies.
Cisco Talos documented the Python-based infostealer PXA Stealer in November 2024. Talos identified targeting in the government and education sectors in Europe and Asia.
The principal developer identified as Nguyen reportedly taught himself Python and C++ beginning in 2023, laying the groundwork for later development of PXA Stealer.
Thanh Hoa provincial police announced charges against 12 suspects tied to a global malware distribution ring centered on PXA Stealer. Authorities said the operation infected more than 94,000 computers worldwide and charged the suspects under Articles 285 and 289 of the Vietnamese Penal Code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcee.vnexpress.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Vietnamese-speaking cybercriminal operation is distributing the Python-based **PXA Stealer** through phishing ZIP archives disguised as documents. The archives use hidden and system file attributes to obscure their contents and include renamed, legitimately signed executables—including Microsoft Word 2013, `winword.exe`, Haihaisoft PDF Reader, and WinRAR—used to DLL-side-load malicious payloads. In one execution chain, a renamed Microsoft-signed `winword.exe` loads a malicious `AppvIsvSubsystems64.dll`, which reconstructs a subsequent command from a padded Korean-named document; a WinRAR binary masquerading as a PNG then extracts further components. The operators also stage a signed Python interpreter as `C:\Users\Public\Windows\svchost.exe` and use obfuscated Python code to hinder detection and sandbox analysis. PXA Stealer collects browser passwords, cookies, autofill and payment-card data, authentication tokens, cryptocurrency-wallet information, and other application data. Stolen data is routed through Cloudflare Workers and related intermediary infrastructure to Telegram bots and channels, supporting a broader Telegram-based criminal ecosystem associated with Sherlock-related services that resell and reuse compromised information. Researchers identified more than 4,000 victim IP addresses in 62 countries, with South Korea, the United States, the Netherlands, Hungary, and Austria among the most affected; Cloudflare was notified and disrupted reported malicious Worker infrastructure.
Sep 25, 2026
Researchers reported overlapping malware campaigns that use fake or trojanized PDF reader packages to compromise Windows systems through **DLL sideloading**. Cisco Talos identified **PXA Stealer** targeting government and education organizations, while Beazley Security and SentinelLabs said the Python-based infostealer has operated at scale since late 2024, affecting more than **4,000 victims in 62 countries**. The activity has been linked to Vietnamese-speaking threat actors who used phishing, signed software such as **Haihaisoft PDF Reader** and **Microsoft Word 2013**, and multi-stage loaders to evade detection and establish persistence through Windows `Run` registry keys. The malware chains ultimately steal browser credentials, cookies, autofill data, cryptocurrency wallet contents, and other sensitive application data, with exfiltration routed through **Telegram bots** and **Cloudflare Workers** and ties observed to the **Sherlock** stolen-data marketplace. In a related development, Kroll said **XWORM** operators adopted a similar fake PDF reader delivery chain using **Ghost Crypt**, packaging a renamed Haihaisoft executable, a malicious DLL, and a decoy PDF in a ZIP archive. That infection path uses a "process hypnosis" technique to inject payloads into `csc.exe`, persists via `rundll32.exe`, and ends with a plugin-based RAT capable of information theft and ransomware-related actions.
Aug 14, 2026
A Vietnamese cybercriminal group known as Lone None has orchestrated a sophisticated phishing campaign that leverages fake copyright infringement notices to target individuals and organizations globally. The campaign, active since at least November 2024, begins with emails purporting to be from legitimate law firms, demanding the removal of allegedly infringing content from the recipient’s website or social media accounts. These emails are highly convincing, often referencing the recipient’s real online profiles and are translated into at least ten languages, including English, French, German, and Chinese, indicating a broad international targeting strategy. The phishing messages contain links that direct victims to download compressed archives, such as ZIP files, which masquerade as legal evidence documents in formats like PDF or PNG. Upon extraction, these archives contain malware that is executed using DLL side-loading, a technique that abuses trusted, signed applications—such as Microsoft Word or PDF readers—to bypass security controls and run malicious code undetected. The campaign delivers two primary types of information-stealing malware: Pure Logs Stealer and the more recent Lone None Stealer, also known as PXA Stealer. Pure Logs Stealer is designed to harvest a wide array of sensitive data, including passwords, credit card details, session cookies, and cryptocurrency wallet files stored on the victim’s device. The Lone None Stealer, first tracked by Cofense Intelligence in June 2025, is specifically engineered to target cryptocurrency assets. It monitors the victim’s clipboard for copied crypto wallet addresses and surreptitiously replaces them with addresses controlled by the attackers, thereby redirecting any intended cryptocurrency transfers. The campaign’s technical sophistication is further demonstrated by its use of Telegram bot profile pages for initial payload delivery and the deployment of obfuscated, compiled Python scripts to evade detection. Cofense Intelligence has observed that Lone None Stealer has appeared in 29% of all active threat reports involving Pure Logs Stealer since June 2025, highlighting its growing prevalence. The attackers also employ machine translation or AI tools to generate new email templates, allowing them to rapidly adapt and expand their reach. To further evade analysis and detection, the campaign abuses legitimate software such as Haihaisoft, leveraging their signed binaries for malicious purposes. The ongoing evolution of the campaign’s tactics, techniques, and procedures (TTPs) demonstrates a high level of operational agility and technical capability. The campaign’s focus on both personal and financial data, with a particular emphasis on cryptocurrency theft, poses significant risks to individuals and organizations alike. Security researchers recommend heightened vigilance for unsolicited legal notices, especially those containing download links or attachments, and advise organizations to implement robust email filtering and endpoint protection measures. The use of legitimate-looking legal threats and multi-language support increases the likelihood of successful social engineering, making this campaign particularly dangerous for a global audience. The campaign’s reliance on trusted software for malware execution underscores the importance of monitoring for unusual process behaviors and regularly updating security controls to detect DLL side-loading techniques. Organizations are urged to educate employees about the risks of phishing emails and to verify the authenticity of any legal correspondence received via email.
Jun 29, 2026