Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

SentinelLABS and Beazley Security uncovered a series of infostealer campaigns delivering the Python-based PXA Stealer. The malware, which first appeared in late 2024, has evolved to incorporate sophisticated anti-analysis techniques and a hardened command-and-control infrastructure. Over 4,000 unique victim IP addresses from 62 countries were identified, with South Korea, the United States, and the Netherlands being the most targeted. The stolen data includes passwords, credit card records, and browser cookies. The threat actors, linked to Vietnamese-speaking cybercriminal circles, monetize the stolen data through a subscription-based underground ecosystem that automates resale via Telegram's API. The campaign showcases the growing trend of weaponizing legitimate infrastructure for large-scale information theft and monetization.

The 'Ghost in the Zip' campaign involves the deployment of a Python-based infostealer malware known as PXA Stealer, first identified in late 2024. This malware is designed to harvest sensitive user information such as passwords, credit card details, and browser cookies from infected systems. The campaign has been observed targeting over 4,000 unique IP addresses across 62 countries, with notable concentration in South Korea, the United States, and the Netherlands. The PXA Stealer employs advanced anti-analysis techniques to evade detection and analysis, making it more resilient against traditional security controls. Furthermore, its command-and-control (C2) infrastructure is hardened, enhancing the malware's persistence and operational security. A distinctive feature of this campaign is its integration with Telegram's API, which facilitates a subscription-based underground ecosystem for automated resale and monetization of stolen data. This approach leverages legitimate infrastructure (Telegram) to conduct illicit activities, complicating detection and takedown efforts. The threat actors behind this campaign are linked to Vietnamese-speaking cybercriminal groups, indicating a potentially organized and regionally focused operation. The campaign's tactics include credential harvesting, data theft, and the use of obfuscation and anti-forensic methods, as indicated by the associated MITRE ATT&CK techniques such as T1056.001 (Input Capture), T1036.005 (Masquerading), T1573.001 (Encrypted Channel), and T1027 (Obfuscated Files or Information). Overall, this campaign exemplifies the evolving sophistication of infostealer malware and the increasing use of legitimate platforms for cybercrime monetization.

Detailed information about Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem. Get real-time updates, technical details, and mitigation strat

Title	Severity	Type	Source	Date

Threats Tagged 'pxa stealer'

Filter Threats

Threats Tagged 'pxa stealer'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility