Loading story…
A Vietnamese-speaking cybercriminal operation is distributing the Python-based PXA Stealer through phishing ZIP archives disguised as documents. The archives use hidden and system file attributes to obscure their contents and include renamed, legitimately signed executables—including Microsoft Word 2013, winword.exe, Haihaisoft PDF Reader, and WinRAR—used to DLL-side-load malicious payloads. In one execution chain, a renamed Microsoft-signed winword.exe loads a malicious AppvIsvSubsystems64.dll, which reconstructs a subsequent command from a padded Korean-named document; a WinRAR binary masquerading as a PNG then extracts further components. The operators also stage a signed Python interpreter as C:\Users\Public\Windows\svchost.exe and use obfuscated Python code to hinder detection and sandbox analysis.
PXA Stealer collects browser passwords, cookies, autofill and payment-card data, authentication tokens, cryptocurrency-wallet information, and other application data. Stolen data is routed through Cloudflare Workers and related intermediary infrastructure to Telegram bots and channels, supporting a broader Telegram-based criminal ecosystem associated with Sherlock-related services that resell and reuse compromised information. Researchers identified more than 4,000 victim IP addresses in 62 countries, with South Korea, the United States, the Netherlands, Hungary, and Austria among the most affected; Cloudflare was notified and disrupted reported malicious Worker infrastructure.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
A July 2025 PXA Stealer wave used a signed Microsoft Word 2013 executable with a malicious msvcr100.dll for DLL sideloading. It displayed a fake copyright-infringement notice in a benign Tax-Invoice-EV.docx decoy, decoded and extracted an archive, then ran a Python payload with browser-injection capabilities.
An April 2025 campaign wave used a signed Haihaisoft PDF Reader executable and a malicious DLL for sideloading, establishing persistence and retrieving further payloads from Dropbox. The wave delivered LummaC2 and Rhadamanthys Stealer and used certutil, a malformed PDF with an embedded encrypted RAR archive, renamed WinRAR, and a renamed Python interpreter.
The Python-based PXA Stealer campaign became active in late 2024; some associated Telegram BotIDs were created as early as October 2024. The operators were assessed as linked to Vietnamese-speaking cybercriminal circles.
Researchers notified Cloudflare that the campaign was abusing Cloudflare Workers as relays for Telegram-based data exfiltration. Cloudflare took action to disrupt the reported infrastructure.
A phishing campaign used ZIP archives masquerading as document downloads to sideload a malicious AppvIsvSubsystems64.dll through a renamed, signed winword.exe. The chain used a WinRAR executable disguised as a PNG and staged a signed Python interpreter as C:\Users\Public\Windows\svchost.exe, with a PYMEOMEO-obfuscated Python payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 95 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcecommunity.fortinet.com
Open sourcelab52.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported overlapping malware campaigns that use fake or trojanized PDF reader packages to compromise Windows systems through **DLL sideloading**. Cisco Talos identified **PXA Stealer** targeting government and education organizations, while Beazley Security and SentinelLabs said the Python-based infostealer has operated at scale since late 2024, affecting more than **4,000 victims in 62 countries**. The activity has been linked to Vietnamese-speaking threat actors who used phishing, signed software such as **Haihaisoft PDF Reader** and **Microsoft Word 2013**, and multi-stage loaders to evade detection and establish persistence through Windows `Run` registry keys. The malware chains ultimately steal browser credentials, cookies, autofill data, cryptocurrency wallet contents, and other sensitive application data, with exfiltration routed through **Telegram bots** and **Cloudflare Workers** and ties observed to the **Sherlock** stolen-data marketplace. In a related development, Kroll said **XWORM** operators adopted a similar fake PDF reader delivery chain using **Ghost Crypt**, packaging a renamed Haihaisoft executable, a malicious DLL, and a decoy PDF in a ZIP archive. That infection path uses a "process hypnosis" technique to inject payloads into `csc.exe`, persists via `rundll32.exe`, and ends with a plugin-based RAT capable of information theft and ransomware-related actions.
Aug 14, 2026
Vietnamese authorities in Thanh Hoa province charged 12 suspects linked to a global malware operation built around **PXA Stealer**, a Python-based infostealer that allegedly compromised more than 94,000 computers across Europe, the Americas, and Asia. Investigators said the malware campaign was technically led by a self-taught Vietnamese high school student identified only as Nguyen, who reportedly used the Telegram handle **"Lone None"** and helped develop tooling that harvested browser cookies, saved passwords, and autofill data from infected systems. Police said the group distributed the malware through mass-email campaigns using executables disguised as PDFs and other routine documents, often packaged in compressed archives and sent with purchased email lists and automated bulk-delivery tools. Stolen data was reportedly exfiltrated through Telegram bots and supported by VPS-hosted infrastructure that also enabled remote access to victim machines; investigators linked the operation to the theft of more than 200,000 credentials and over 4 million browser cookies, and said suspects were charged under Vietnamese laws covering illegal tool production and unlawful access to computer networks and electronic devices.
Aug 17, 2026
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026