Infostealer malware is behind a large share of today's credential compromise — and it usually doesn't start with a breach at all. When a security team hears "data breach," the instinct is to look for the moment a database was exfiltrated or a network was penetrated. But more often, the real starting point is a single endpoint infection, often on a personal device, that has nothing to do with the organization's perimeter.

By the time stolen credentials show up in a breach notification or a dark web alert, they've already passed through several distinct, mechanical stages. Understanding that pipeline — rather than waiting for the final alert — is what separates reactive security teams from ones that catch exposure early.

How Infostealer Malware Powers the Credential Theft Pipeline?

What follows is a stage-by-stage breakdown of that journey — from the moment infostealer malware first executes on a device, through the log assembly and enrichment steps that add value along the way, to the final point where credentials are packaged and sold on the open market. Each section builds directly on the one before it, showing exactly how a single infection turns into an inventoried, priced, and marketable product.

Execution and Harvesting 

The pipeline begins with infostealer malware — a lightweight piece of software designed to do one thing efficiently: grab whatever credentials, cookies, and session tokens are sitting in a browser or application on the infected machine. This is the core mechanism behind modern credential harvesting, and these tools typically arrive through cracked software installers, fake game cheats, malicious browser extensions, or phishing lures disguised as invoices or shipping notices. 

Once executed, the stealer doesn't loiter. It targets browser credential stores, autofill data, saved payment details, cryptocurrency wallet files, FTP client configurations, and any session cookies that could allow an attacker to bypass login screens entirely. Many stealers also grab system fingerprinting data — IP address, hardware ID, installed software — which becomes useful later for building convincing sessions or bypassing device-based fraud checks. 

The output of this stage is a "log": a structured folder of text files, often just a few kilobytes, containing everything the malware could pull from that one machine. These stealer logs are the raw currency of the entire pipeline that follows. 

Aggregation and Log Assembly 

A single log is not particularly valuable on its own. Its worth comes from volume. Threat actors operating stealer campaigns typically run panels — command-and-control dashboards — that collect incoming logs from hundreds or thousands of infected machines simultaneously. These logs get bundled into larger archives, sometimes labeled by infection date, campaign, or targeted region. 

This is the point where individual credential theft becomes an inventory problem for the attacker. Logs get sorted, deduplicated, and screened for anything obviously valuable — corporate VPN logins, SaaS admin panels, banking portals — versus low-value consumer accounts. 

Parsing and Enrichment 

Raw logs are messy, so a parsing step usually follows before anything is sold or shared. Automated tools and, in some cases, manual review are used to extract structured fields: username, password, URL, and associated cookies, organized into searchable formats. This is also where enrichment happens — cross-referencing a log against previously leaked datasets to add context like a person's employer, job title, or other accounts tied to the same email address. 

Enrichment matters because it changes the value proposition. A raw password paired with a login URL is interesting. That same credential paired with confirmation that it belongs to an IT administrator at a mid-sized company is something else entirely — and priced accordingly.  

It's also at this stage that enriched credentials become prime material for credential stuffing campaigns, where attackers automate login attempts across dozens of unrelated services in the hope that a password was reused. 

Marketplace Listing 

The final stage is distribution. Parsed and enriched logs are listed for sale on dark web marketplaces and forums, sometimes as full archives ("bulk logs") and sometimes broken apart and sold as individual access credentials to specific platforms — a corporate email account, a cloud console login, a remote desktop session. Listings often include partial samples as proof of authenticity, along with metadata like infection date, geography, and browser type, to help buyers judge freshness and relevance. 

This is usually the first point where an outside observer — including a security team — has a realistic chance of spotting exposure, provided they're actually looking at this layer of the ecosystem rather than waiting for a breach disclosure further downstream. 

Why the Earlier Stages Matter More Than the Alert? 

Most detection strategies are built around the last step: someone notices a listing or a breach compilation and issues an alert. But by then, the credential may have already changed hands, been tested against multiple services, or been bundled into a larger fraud operation. The earlier stages — infection, log assembly, and enrichment — are where exposure actually originates, and where it can be caught closer to the source. 

For SOC teams and identity security leads, the practical takeaway is that credential exposure isn't a single event to monitor for — it's a pipeline to monitor across. Visibility into stealer logs, marketplace chatter, and enrichment activity gives a much earlier warning than waiting for a finished, packaged breach. 

Your Credentials Are Probably Already for Sale. You Just Don't Know It Yet. 

Somewhere right now, an infostealer log sits in a marketplace listing with your company's name attached to it — and nobody on your team has seen it. That's not a scare tactic. It's the default state for most organizations, because credential exposure happens quietly, on devices you don't control, long before it ever becomes "your" incident. 

The only real question is whether you find out from a threat feed, or from a breach headline. 

See what's already exposed — before someone else finds it first. Run a free check with Cyble and get a real answer, not a guess. 

The post From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline appeared first on Cyble.

Anthropic has warned some Claude users that criminals are using information stealers to take over their accounts.

Rather than guessing passwords or intercepting two-factor authentication (2FA) codes, the attackers steal the browser sessions that prove a user is already logged in.

According to a warning email shared publicly by an affected user, the attackers used common infostealer malware to copy Claude login sessions from victims’ computers. They then used those sessions to access the accounts and consume their usage.

“We recently signed you out of Claude and removed the payment method saved on your account, so you’ll need to log back in and re-add your card. We’re sorry for the disruption. Here’s what happened and what we’ve done about it.

What happened

We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage. Our systems detected this activity on your account, and we’ve therefore removed your card on file and signed out the sessions involved to help block further unauthorized access.

If your usage limits looked like they refilled and then drained while you weren’t using Claude, this was likely the cause.”

The message adds that Anthropic has no reason to believe the malware was “related to Claude, installed through Claude, or related to anything you did with Claude.”  

To sum this up:

• Cybercriminals are spreading infostealers. How they are doing this and whether they are targeting groups likely to use Claude professionally is unknown.
• Infostealers can bypass standard credentials and multi-factor authentication (MFA) by stealing active browser sessions and session cookies.
• Once they are able to take over a Claude account, they can consume the victim’s usage and potentially incur additional charges.
• Anthropic is signing affected users out of Claude, removing saved payment methods, and refunding charges it identifies as unauthorized.

To better understand this, you should know that paid Claude plans can offer additional “Usage credits.” When a subscriber reaches the plan’s session limit, Claude can allow them to continue using the service through consumption-based billing at standard API rates. The user must enable the feature, configure a monthly spending limit or select unlimited spending, and prepay for credits.

Users can also enable auto-reload, which automatically buys more prepaid credits when the balance falls below a threshold. So, in a session-hijacking scenario, a thief could use up the account’s included allowance and any available Usage credits. If auto-reload is enabled, they could also trigger further purchases.

The criminals’ likely motive is to use paid Claude capacity for free. The account and any exposed data could also be useful for fraud, social engineering, or follow-on attacks.

Stolen Claude capacity could be used to write and refine phishing and scam content, build campaign infrastructure, develop, modify, or obfuscate malware, improve delivery methods, and analyze stolen information. Cybercriminals can use AI to support several parts of an operation, although Claude has safeguards and abuse monitoring, and Anthropic says it has disrupted accounts used for malicious activity.

What to do

Anthropic provided advice for dealing with a possible infostealer infection. After removing the malware, we recommend you install an up-to-date, real-time anti-malware solution to help protect you against new infections.

These steps are good practice when cleaning up after infostealer malware:

1. Scan any computer you use with Claude for malware and remove any malware before logging back in or changing passwords.
2. Once the malware has been removed, secure the email account you use for Claude by changing its password, signing out of other devices, and enabling two-factor authentication (2FA).
3. Change sensitive passwords that were saved in the affected browser, including those for banking, work, and cloud services. Check your card statements if you stored payment details in the browser.
4. Only after completing these steps should you add your payment method to Claude again if you want your plan to continue renewing.

If you still see your usage changing while Claude is idle, or notice an unrecognized charge after completing these steps, contact usersafety@anthropic.com.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute agentic financial fraud.

The post OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat appeared first on Unit 42.

Executive Summary

Cyble Research and Intelligence Labs (CRIL) has uncovered a targeted cyberespionage campaign leveraging social engineering and trusted infrastructure to establish persistent, covert access to victim systems.

The attack is delivered via phishing emails containing a malicious LNK file disguised within a RAR archive, using a Russian humanitarian aid request form to exploit contextual trust. Evidence of a secondary survey-based lure indicates the threat actor is actively refining delivery techniques.

Execution triggers a stealthy, multi-stage infection chain in which a decoy document is presented to the user while a heavily obfuscated, fileless (PE-less) Python-based implant is silently deployed.

The payload is retrieved from GitHub Releases, enabling the attacker to blend malicious traffic with legitimate services and evade traditional detection mechanisms. Persistence is established through scheduled tasks, ensuring long-term, resilient access.

Once active, the implant operates as a full-spectrum surveillance platform, enabling credential harvesting, keystroke logging, clipboard and screenshot capture, sensitive data exfiltration, and covert remote access. The campaign prioritizes continuous intelligence collection while maintaining a low operational footprint and minimal user visibility.

While attribution remains inconclusive, the artifacts strongly suggest a deliberate intelligence-gathering operation likely targeting Russian-speaking individuals or entities.

Key Takeaways

• The LNK file contains self-obfuscated content that is extracted and executed by PowerShell, using a deliberate technique to evade automated sandbox analysis.
• Multiple lure types themed around humanitarian aid, written in Russian, have been observed, suggesting the intended targets are Russian-speaking individuals, and the threat actor is actively adapting delivery approaches.
• The payload is obfuscated using PyArmor and hosted on GitHub Releases, a deliberate combination to evade static detection and bypass network-level security controls.
• During analysis, the implant was observed collecting browser credentials, session cookies, keystrokes, clipboard data, screenshots, Telegram session data, and sensitive files from the victim's machine.
• Remote desktop access is established silently using RustDesk or AnyDesk, giving the attacker persistent interactive access to the victim's machine with no visible window.
• Persistence is achieved through a Windows Scheduled Task that survives system reboots, ensuring the implant remains continuously active in the background.
• The threat actor behind this campaign has not been conclusively attributed. The campaign uses a surveillance-first, PE-less Python architecture and custom C2 infrastructure, consistent with a targeted espionage operation.

Technical Analysis

This section provides a detailed walkthrough of the attack chain, from initial delivery to payload execution and data collection, based on static and dynamic analysis of the identified samples.

Stage 1: Malicious LNK File Delivery

The infection begins with a Windows shortcut file delivered to the target.

The LNK file is significantly larger than a typical Windows shortcut, as it contains self-obfuscated Unicode content embedded within its body. PowerShell reads this content from a specific offset, decodes it, and executes it in memory. This is a deliberate anti-sandbox technique, as the malware will not execute if the original file is absent from disk, making it appear clean to automated scanning tools.

Stage 2: Decoy Lure Delivery

Upon execution, the malware downloads a Russian-language humanitarian aid request form ("O predostavlenii gumanitarnoy pomoshchi") from the C2 server, saves it to %TEMP%\open_doc, and displays it to the victim. The lure of both the RAR archive and the LNK file reference humanitarian aid, reinforcing the lure's credibility.

While the victim reads the document, the real installation runs silently in the background. A second variant involving a survey link (hxxp[:]//159.198.41.140/test/index.php?r=survey/index&sid=936926&newtest=Y&lang=ru%22) has also been observed.

Stage 3: Python Environment Bootstrap

The malware creates a fully self-contained Python environment inside the user's %appdata% folder, requiring no administrator privileges.

`The installation directory is named WindowsHelper to mimic a legitimate Windows system component. The malware correctly handles a known technical requirement for Python's embedded distribution (patching the ._pth file to enable pip), a detail that reflects genuine developer skill. The following Python libraries are installed, each enabling a specific capability:

Stage 4: Payload Download and Persistence

The main payload is downloaded from a dedicated GitHub account. Storing it in GitHub Releases rather than the repository code is a deliberate evasion choice, as release artifacts receive less scrutiny from automated scanners and updates can be pushed silently with no commit history. The same account also hosts clean, legitimate files, including the Python embedded runtime and pip installer, making the entire download chain appear as normal GitHub traffic.

Beyond the malicious payload, the same GitHub account also hosts the Python embedded runtime (python-3.12.10-embed-amd64.zip) and the pip installer (get-pip.py) as separate release tags. These are clean, legitimate files. Hosting them on the same repository allows the attacker to download and bootstrap the entire Python environment from a single trusted source, making the full installation chain appear as normal GitHub traffic to network monitoring tools.

The attacker's GitHub Release page shows frequent republishing of data.zip, with its sha256 hash changing across versions, confirming the threat actor remains active and is continuously updating the campaign payload.

Persistence

Two silent VBScript launchers, run.vbs and launch_module.vbs, invoke the payload through pythonw.exe with no visible window.

A Windows Scheduled Task named “WindowsHelper” is registered to run at a short recurring interval, ensuring the implant persists across reboots and remains continuously active in the background.

Stage 5: Active Payload Capabilities

The main payload, module.pyw, is protected with PyArmor v9.2 Pro, a commercial obfuscation tool that converts Python bytecode into a format that resists static analysis and decompilation. Analysis of the disassembled bytecode revealed the following active capabilities:

Browser Credential and Cookie Collection

The implant collects stored passwords and session cookies from all major Chromium-based browsers, including Firefox. For Chromium browsers, it extracts the AES-GCM master key from the Local State file and uses it to decrypt stored credentials. It handles both legacy DPAPI-based decryption and newer Chrome encryption schemes (v10, v11, and v20).

• Target browsers: Chrome, Edge, Brave, Opera, Yandex Browser, Firefox
• Functions identified in bytecode: get_master_key, decrypt_chromium_data, extract_chromium_passwords, collect_and_send_cookies, extract_login_data, extract_firefox_passwords

Keylogging

Keystrokes are captured continuously via the keyboard library, stored in keystrokes_log.txt, and periodically uploaded to the C2 server.

Clipboard Monitoring

The malware monitors clipboard contents in real time using the pyperclip library. Any text copied by the victim, including passwords, tokens, and other sensitive content.

Screenshot Capture

The mss library captures continuous desktop screenshots, which are archived as ZIP files and uploaded periodically. Old archives are automatically cleaned up to avoid excessive disk usage.

File Collection

The implant recursively scans user directories, skipping system folders and low-value file types, to collect documents, configuration files, and credential stores.

This selective filtering is designed to identify high-value files, including documents, configuration files, source code, and credential stores on the Desktop, in Documents, and similar user locations.

A SQLite database inventory_state.db tracks scanned files to avoid re-uploading unchanged content. Files are also scanned for 64-character hexadecimal strings consistent with cryptocurrency private keys.

Telegram Session Collection

The tdata session folder is extracted and uploaded, giving the attacker full access to the victim's Telegram account without requiring a password.

Remote Access via RustDesk and AnyDesk

Static analysis of the payload reveals the capability to silently download and install RustDesk and AnyDesk. RustDesk, signed by Open Source Developer Huabing Zhou, is a legitimate remote desktop tool that is being abused here to blend in with normal software. The code is designed to hide the application window from the victim and to send the connection credentials back to the C2 server, potentially giving the attacker persistent remote desktop access.

Command and Control Infrastructure

All collected data is transmitted to a single attacker-controlled server. The server hosts a custom-built login panel (Login - Dashboard) that the attacker can use to access all collected data, monitor active implants, and initiate remote desktop sessions.

The C2 server was confirmed live and serving the attacker's login panel as of May 2026. The use of a commercial VPS provider with low-friction provisioning reflects a common pattern among threat actors seeking to quickly deploy and replace infrastructure.

Attribution:

The intended targets of this campaign appear to be Russian-speaking individuals, as evidenced by the Russian-language lure content referencing humanitarian aid. The use of a humanitarian aid application form as a decoy suggests the targets may include individuals or organizations involved in aid distribution, civil administration, or related government functions.

Conclusion

This campaign represents a well-constructed, technically capable cyberespionage operation. The attacker combines a convincing Russian-language humanitarian aid lure with a multi-stage infection chain that silently deploys a full-featured surveillance platform on victim machines.

The Python implant goes beyond credential collection. It enables the attacker to monitor every action a victim takes, collect active browser sessions, capture communications, and maintain live remote desktop access.

The use of PyArmor v9.2 Pro for payload obfuscation, GitHub Releases for payload hosting, and a custom Flask C2 panel demonstrates a technically skilled and operationally disciplined threat actor.

The campaign is active and ongoing. The Russian-language lure content and humanitarian aid theme point to Russian-speaking individuals as the intended target audience.

The use of multiple lure types, particularly humanitarian ones, indicates active development and adaptation. Organizations and individuals should treat this as an active threat and apply the recommendations in this report.

Recommendations

• Treat unsolicited files received through email or messaging platforms with caution, especially compressed archives and shortcut files. Verify the sender through a separate trusted channel before opening any attachment.
• Enable file extension visibility in Windows to prevent files from being disguised using misleading names or double extensions.
• Regularly audit the Windows Task Scheduler for unexpected or newly created tasks, particularly those scheduled to run at short, recurring intervals without a known business justification.
• Monitor endpoint activity for the creation of self-contained scripting environments in user-writable directories, as this is a common technique for executing malicious code without administrative privileges.
• Block outbound network traffic to known malicious infrastructure at the perimeter and alert on downloads from newly registered or low-reputation hosting accounts on code-sharing platforms.
• Monitor for the silent installation of remote desktop tools by non-administrative processes, as legitimate software abused for remote access is a growing attacker technique that can be difficult to detect without process-level visibility.
• Deploy endpoint detection rules targeting obfuscated or packed script files appearing in non-standard user directories, as commercially packed payloads are increasingly used to evade static analysis.
• Ensure security teams have visibility into scheduled task creation, scripting interpreter activity, and outbound HTTP connections from user-space processes, as these are the primary indicators of this class of threat.

MITRE ATT&CK TTPs

Indicators of Compromise (IOCs)

The post Operation HumanitarianBait: An Infostealer Campaign in Disguise appeared first on Cyble.

Unit 42 uncovers high-risk AI browser extensions. Disguised as productivity tools, they steal data, intercept prompts, and exfiltrate passwords. Protect your browser.

The post That AI Extension Helping You Write Emails? It’s Reading Them First appeared first on Unit 42.

Executive Summary

CRIL has been actively tracking a surge in PXA Stealer activity deployed in a sophisticated, financially motivated threat campaign attributed with high confidence to a Vietnam-based cybercriminal group. The primary targets in this campaign are job seekers across India, Bangladesh, the Netherlands, Sweden, and the United States.

Threat actors leverage LinkedIn as their primary initial access vector, distributing fraudulent recruitment messages via compromised accounts that impersonate legitimate job opportunities.

What makes this threat particularly dangerous is the potential for propagation: compromising one’s LinkedIn account, especially with many connections (such as recruiters or HR personnel), can lead to an exponentially higher rate of further infection. This new trend requires users to be wary when using any social networking platform, even those for professional use.

The infection ultimately delivers a multi-stage information stealer designed to harvest sensitive data, including browser-stored credentials, cryptocurrency wallet information, two-factor authentication (2FA) tokens, hardware wallet artifacts, and email client credentials.

The attack chain demonstrates significant operational sophistication:

• Adversaries abuse trusted cloud and professional platforms—including LinkedIn, Google Forms, and Dropbox—to evade reputation-based security controls and increase victim trust.
• Execution relies on a legitimate Microsoft 365 binary leveraged for DLL sideloading, while the malicious DLL is artificially inflated to approximately 100 MB to bypass size-based inspection mechanisms.
• The final payload executes entirely in memory, minimizing disk artifacts and complicating forensic detection.

This sophistication makes PXA Stealer a potent threat to job seekers in the targeted countries, and the list of victims may expand in the near future.

At the time of analysis, the campaign remained active and continued to propagate laterally through compromised LinkedIn accounts, leveraging victims’ professional networks to further distribute job-themed phishing lures.

The image below shows the Malware profile summary for PXA Stealer from Cyble’s Vision Threat Intelligence.

The real-world impact of this lateral spread is evidenced by multiple LinkedIn users publicly reporting that their accounts were compromised and used to distribute fraudulent Apex Logistics Group recruitment messages to their professional connections, as shown below.

Key Takeaways

• Attribution: The campaign is attributed with high confidence to PXA Stealer, tied to a Vietnam-based cybercriminal actor. This is further supported by Vietnamese-language strings embedded within malware samples and overlaps with previously documented activity clusters.
• Initial Access Vector: Threat actors initiate compromise through LinkedIn direct messages, impersonating recruiters from a fabricated logistics entity, Apex Logistics Group, using job-themed social engineering lures.
• Payload Delivery Chain: Victims are redirected through a staged delivery workflow that includes a Google Form, followed by a shortened URL pointing to a Dropbox-hosted ZIP archive. The payload exhibited zero antivirus detections on VirusTotal at the time of discovery.
• Execution Mechanism: Malware executes via DLL sideloading using a legitimate, signed Microsoft Office binary (winword.exe), enabling trusted-process execution and reducing behavioral suspicion.
• Defense Evasion: The malicious DLL is artificially inflated to approximately 100 MB to evade size-threshold scanning mechanisms. The final payload executes entirely in memory through Python exec() functionality, leaving minimal disk artifacts during runtime.
• Command-and-Control (C2): The malware dynamically retrieves its C2 infrastructure from an encrypted Telegram channel. The final payload is hosted on an IP address configured to masquerade as Chinese government infrastructure, likely to hinder attribution and evade network reputation controls.
• Objectives: The infostealer’s primary objective is data theft, targeting a broad range of sensitive assets, including:
  • Browser credentials and session data
  • Cryptocurrency wallets and Ledger Live artifacts
  • Two-factor authentication (2FA) and authenticator data
  • Desktop and email client credentials

• Persistence Mechanism: Persistence is established via a scheduled task registered under a name mimicking a legitimate Microsoft Edge update process, blending malicious activity with normal system operations.

Overview

PXA stealer is tied to a Vietnam-linked threat actor who conducted a targeted campaign across multiple countries by impersonating recruiters on LinkedIn and distributing fabricated part-time job opportunities as social engineering lures.

Victims are guided through a staged delivery chain leveraging trusted platforms, including a Google Form, a shortened URL, and a Dropbox-hosted ZIP archive, allowing the malicious payload to evade reputation-based defenses and achieve zero detections on VirusTotal at the time of discovery.

Upon opening the archive, victims unknowingly executed a disguised Microsoft Word binary that initiated a DLL sideloading attack. The sideloaded DLL is artificially inflated to approximately 100 MB, a deliberate evasion technique designed to bypass automated file-scanning and size-threshold inspection mechanisms.

A concealed batch script subsequently deployed the next-stage payload, established persistence via a scheduled task masquerading as a legitimate Microsoft Edge update process. It launched the final infostealer entirely in memory. Execution relied on multiple layers of encoding—including XOR, Base64, bzip2, and zlib—to obscure payload functionality and minimize forensic artifacts on disk.

PXA Stealer: History and Evolution

PXA Stealer is not a new threat. First publicly documented by Cisco Talos in November 2024, it has undergone continuous, rapid evolution. What began as a straightforward Python-based infostealer has matured into a sophisticated, multi-stage operation backed by an organized criminal ecosystem. Understanding this evolution is critical to anticipating the threat actor's next moves.

The name PXA is tied directly to its original developer, Phan Xuan Anh (PXA), a Vietnamese national who commissioned a high school programmer to develop the malware in late 2024. Vietnamese law enforcement subsequently indicted 12 suspects in early 2026, including the student developer, as part of a global operation that had infected over 94,000 computers worldwide.

Comparative TTP Analysis: PXA Stealer Campaigns

The table below cross-references TTPs observed in this campaign against prior PXA Stealer analyses by Cisco Talos (November 2024) and SentinelOne (August 2025). The consistent overlap across delivery, obfuscation, persistence, and exfiltration techniques provides strong technical justification for attributing this activity to the PXA Stealer malware family.

What Should Businesses Expect When Infected with PXA Stealer?

PXA Stealer's immediate impact is severe and rapid. Within minutes of execution, all browser-stored credentials, active session cookies, cryptocurrency wallets, and 2FA tokens are exfiltrated. Attackers can bypass MFA entirely using harvested session cookies, and email account access enables Business Email Compromise before the victim even notices the infection.

Shortly thereafter, the victims' credentials are stolen, and their own LinkedIn profile is turned into a distribution channel for further attacks.

Organizations face regulatory breaches of notification requirements under GDPR or DPDPA, long-term persistent access risks, and lasting reputational damage, particularly for fintech and crypto-facing businesses.

Technical Analysis:

Initial Access — LinkedIn Phishing

The threat actor established initial contact via direct messages on a compromised LinkedIn account, posing as a recruiter affiliated with a logistics sector firm. The lure offered a remote, part-time digital marketing role, a format deliberately calibrated to exploit the professional context LinkedIn provides.

With 1.3 billion active users, LinkedIn is the largest professional networking platform. Users would naturally expect and engage with career-related outreach, particularly job seekers. This significantly lowers their caution threshold when compared to unsolicited emails or social media messages from trusted contacts on other platforms.

Once contact is established, targets are directed to a Google Form hosted at hxxps://forms.gle/JjAtpy26Tcokow2Q7.

Hosting the next stage on Google’s legitimate infrastructure is intentional: most URL filtering solutions and email security gateways do not flag Google domains, allowing the attacker to preserve the job application narrative while bypassing automated defenses entirely.

Payload Delivery — Trusted Platforms as Staging Infrastructure

Within the Google Form, victims were instructed to review a job description via a hyperlink. The link (hxxps://tr.ee/PRtnsf) was a shortened URL that redirected to a Dropbox-hosted ZIP archive named “Position Details and Compensation Policy (2).zip”. The layering of a URL shortener on top of a trusted cloud storage platform made static analysis significantly more difficult. At the same time, the job-themed filename gave victims no reason to hesitate before opening it.

The downloaded archive registered zero detections on VirusTotal at the time of analysis, demonstrating the effectiveness of this multi-platform delivery chain against conventional security tooling.

Archive Contents — Concealment by Design

Once extracted, the archive presented the victim with a single visible file: what appeared to be a legitimate Microsoft Word executable. All remaining components were deliberately hidden within the archive, including:

• A malicious DLL (AppvIsvSubsystems64.dll)
• Supporting runtime files
• A batch script (en.cmd / en.pip)
• A decoy Word document
• A hidden folder named “__” containing next-stage components (Invoice.pdf, Trend.jpg, support.ico, nsedge.exe, update.dll)

DLL Sideloading:

Executing the visible file — Position Details and Compensation Policy.EXE (a renamed winword.exe) — triggered a DLL sideloading attack. The malicious AppvIsvSubsystems64.dll was loaded in place of the legitimate Microsoft Office counterpart of the same name.

What distinguishes this DLL File is its file size. The clean, signed version of this DLL typically ranges between 1 MB and 3 MB. The malicious variant was deliberately inflated to approximately 100 MB. This technique — known as binary padding — is specifically designed to evade automated scanning pipelines and static analysis tools that impose file size thresholds or skip oversized files to conserve processing resources.

Batch Script Execution and Persistence

Despite its inflated size, the malicious DLL had a single task: copy "en.pip" to "en.cmd" and execute it. From there, the batch script extracted a next-stage payload from a password-protected archive disguised as "Invoice.pdf" into %LOCALAPPDATA%\Microsoft\WindowsApps, deleted the archive and extraction utility to reduce forensic traces, and registered a scheduled task for persistence.

The final payload was launched through a Python executable named "nsedge.exe" alongside "update.dll", both placed inside %LOCALAPPDATA%\Microsoft\WindowsApps. The masquerade here operated on two levels: the folder path mimicked a legitimate Microsoft Edge installation directory. At the same time, the filenames were chosen to resemble trusted Edge components, making the entire setup appear as routine system activity to both analysts and automated detection tools. (See Figure 6)

Multi-Layer Encoding

Despite carrying a DLL extension, "update.dll" was in fact a Python script, executed with the parameter "sunset". Its role was to read encrypted content from a file named "support.ico", decode it using a key embedded within the file itself, and execute the resulting deobfuscated Python script directly in memory using Python's exec() method, leaving no additional files on disk for forensic tools to recover.

The XOR-decoded content was not the final layer. Underneath it was Python bytecode that had been Base64-encoded and compressed with both bzip2 and zlib. In simple terms, the attacker wrapped the malicious code in multiple layers, one inside the other, making it harder and more time-consuming for analysts to unpack and understand what the malware was actually doing.

Command and Control — Telegram-Based Dynamic Infrastructure

Once the final payload executed, the malware contacted a Telegram channel (hxxps://t.me/erik22sucbot) to retrieve the address of its command-and-control (C2) server. Rather than hardcoding the C2 address — a static indicator that can be blocked after discovery — the attacker stored it on Telegram in encrypted form. The malware decrypted the address at runtime, allowing the attacker to rotate infrastructure without recompiling or redeploying the payload.

Using the “sunset” parameter, the script constructed a download URL (hxxp://151.243.109.125/support/links/sunset[.]txt) to retrieve the final stage payload. The IP address 151[.]243[.]109[.]125 is configured to redirect to a Chinese government website — an additional layer of masquerading intended to cast doubt on analyst findings and create the false impression that the payload was hosted on legitimate government infrastructure.

The downloaded file "sunset.txt" was not a text file despite its .txt extension. It was, in fact, a Python script, heavily obfuscated to resist analysis.

Python Bytecode analysis

From the memory strings, we observed the following: it tries to steal the following items.

Network traffic analysis reveals that sensitive data is being exfiltrated to the external IP address 15.235.156[.]143 over port 56001. Outbound communication is concealed within TLS-encrypted traffic, effectively masking its contents and evading content-based inspection. This encryption layer suggests a deliberate attempt to obfuscate data exfiltration, making it difficult to detect with standard deep packet inspection techniques.

Conclusion

PXA’s evolution into a mature, multi-layered attack operation is a concerning development, as it exploits trust at every stage of the kill chain, from the professional credibility of LinkedIn to the reputation of Google, Dropbox, and Microsoft Office binaries.

The threat actors behind this campaign demonstrate strong operational security awareness, evidenced by the deliberate use of legitimate platforms to avoid detection, in-memory payload execution that leaves no on-disk artifacts, dynamic C2 infrastructure managed through Telegram, and multi-layer encoding to resist reverse engineering.

The campaign's continued propagation through victim LinkedIn connections creates a compounding distribution effect: each compromised account becomes a new, trusted sender for the job-lure message, extending the campaign's reach without additional infrastructure investment from the threat actor.

Job seekers, HR professionals, and employees actively engaged on LinkedIn represent the highest-risk population. Organizations in India, Bangladesh, the Netherlands, Sweden, and the United States should treat this campaign as an active threat.

How can Cyble help?

Cyble Vision can help detect compromised credentials and endpoints, monitor known threats, and supplement SOC teams with proactive intelligence to help avoid them even before they are targeted.

A competitive CTI solution, such as Vision, helps users stay a step ahead of threats originating from the surface, deep, and dark web through timely intel, low signal-to-noise ratio, and specific support in the event of an incident or compromise.

Recommendations

• Verify Recruiter Identities Independently: Always confirm recruiter profiles and company legitimacy through official websites or direct calls before engaging with any job offer received via LinkedIn DMs.
• Never Open Unsolicited File Attachments: Do not download or execute ZIP archives, EXE files, or documents received through job application links, even if they appear to come from a trusted connection.
• Enable Multi-Factor Authentication (MFA): Enable MFA on LinkedIn, email, and all critical accounts. Prefer hardware security keys over app-based TOTP, as infostealers can harvest authenticator tokens
• Audit Your LinkedIn Active Sessions Regularly: Periodically review active sessions and connected devices in LinkedIn security settings. Immediately revoke any unrecognised sessions.
• Keep Endpoint Security Tools Updated: Ensure EDR and antivirus solutions are active and up to date. Deploy solutions capable of detecting DLL sideloading, anomalous Python execution, and large, oversized DLL files.
• Monitor for Suspicious Scheduled Tasks: Regularly audit scheduled tasks on endpoints. Flag any tasks with names that mimic legitimate system processes, such as Microsoft Edge update services.
• Educate Employees on LinkedIn-Based Social Engineering: Include LinkedIn phishing scenarios in regular security awareness training. Employees should understand that professional platforms are actively exploited as initial access vectors
• Report and Revoke Immediately if Compromised: If your LinkedIn account is suspected to be compromised, immediately revoke all active sessions, reset credentials, notify your connections, and report the incident to LinkedIn and your security team.

MITRE ATT&CK Mapping

The post Professional Networks Under Attack: Vietnam-Linked Actors Deploy PXA Stealer in Global Infostealer Campaign appeared first on Cyble.

Introduction

Findings

behash:"4acaac53c8340a8c236c91e68244e6cb"

/api/v3/files/09a8b930c8b79e7c313e5e741e1d59c39ae91bc1f10cdefa68b47bf77519be57/execution_parents

signature:"Peastaking plenipotence ductileness chilopodous codicillary."

signature:"© 2026 Eosinophil LLC"

exports:15Mmm95ml1RbfjH1VUyelYFCf exports:2dlSKEtPzvo1mHDN4FYgv

behash:5ddb604194329c1f182d7ba74f6f5946

IOCs

import "pe"

rule win_dll_sideload_eosinophil_infostealer_jan26
{
  meta:
    author = "VirusTotal"
    description = "Detects malicious DLLs (CoreMessaging.dll) from an infostealer campaign impersonating Malwarebytes, Logitech, and others via DLL sideloading."
    reference = "https://blog.virustotal.com/2026/01/malicious-infostealer-january-26.html"
    date = "2026-01-16"
    behash = "4acaac53c8340a8c236c91e68244e6cb"
    target_entity = "file"
    hash = "606baa263e87d32a64a9b191fc7e96ca066708b2f003bde35391908d3311a463"
  condition:
    (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and pe.is_dll()) and
    pe.exports("15Mmm95ml1RbfjH1VUyelYFCf") and pe.exports("2dlSKEtPzvo1mHDN4FYgv")
}