Loading threat actor…
PXA Stealer is a Python-based information-stealing malware operation linked to Vietnamese-speaking threat actors. It has been observed in phishing-delivered campaigns and is designed to harvest login credentials, browser data, and financial information. Reported collection objectives for Python-based stealers associated with this activity include credentials, session cookies, authentication tokens, payment-card data, and cryptocurrency wallet data. Observed PXA Stealer campaigns in late 2025 used phishing for initial access and established persistence through mechanisms such as registry Run keys or scheduled tasks. The operation also used Telegram for command-and-control and data exfiltration. The malware fits the broader trend of cross-platform, rapidly adaptable infostealers implemented in Python and used to support follow-on criminal activity including account compromise, fraud, and broader post-compromise abuse.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.