PXA Stealer

Achat de listes d’e-mails sur des forums en ligne

contrôle des machines infectées via des serveurs privés virtuels (VPS)

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

During a wave of attacks occurring in April 2025, users were phished or otherwise lured into downloading a compressed archive... The large archive attached to the phishing lure contained...

Fichiers exécutables déguisés en PDFs ou documents ordinaires, distribués par campagnes d’e-mails massifs

T1566.002 — Phishing: Spearphishing Link (Initial Access)

Threat actors have moved away from purpose-built malicious infrastructure and toward legitimate, high-reputation sending platforms that email security tools are configured to trust. Mimecast’s telemetry shows that among these campaigns, about one in three detections arrived through Salesforce infrastructure, with another quarter delivered through Google Workspace mail-merge tools and SharePoint-hosted links.

Upon execution, the malicious DLL creates a .CMD script Evidence.cmd in the current directory, which orchestrates all subsequent steps in the attack chain... The sideloaded DLL then launches a hidden instance of Command Prompt and begins a multi-stage chain of activity.

the threat actors shifted to updated Python-based payloads instead of Windows executables... This extracts several Python dependencies, including a legitimate Python 3.10 interpreter renamed svchost.exe and a malicious Python script named Photos

Fichiers exécutables déguisés en PDFs ou documents ordinaires

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

Attackers who gain access often add their own admins and downgrade the legitimate owner to a limited role, something platform permission structures don’t always let a newly added admin reverse.

This component of the attack is responsible for establishing persistence on the target host via the Windows Registry... This step sets a Registry Run key to ensure the payload will run each time the computer starts.

The infostealer will also attempt to inject a DLL into running instances of browsers such as Chrome, targeting Chrome’s App-Bound Encryption Key to defeat the internal encryption schemes within Chrome.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

Attackers who gain access often add their own admins and downgrade the legitimate owner to a limited role, something platform permission structures don’t always let a newly added admin reverse.

This component of the attack is responsible for establishing persistence on the target host via the Windows Registry... This step sets a Registry Run key to ensure the payload will run each time the computer starts.

These campaigns use elaborate staging layers that obscure their purpose and delay detection... launches a heavily obfuscated Python script... Once downloaded, the obfuscated Python code is decoded and executed

embedded archives disguised as common file types... a legitimate WinRar executable also hosted in the “-“ folder renamed images.png... The Python interpreter is renamed to svchost.exe and launches a heavily obfuscated Python script again disguised as images.png

T1036.002 — Masquerading: Right-to-Left Override (Defense Evasion)

The infostealer will also attempt to inject a DLL into running instances of browsers such as Chrome, targeting Chrome’s App-Bound Encryption Key to defeat the internal encryption schemes within Chrome.

Ad account theft, the systematic hijacking of Meta Business Manager and Google Ads accounts, has grown into a commodity-driven cybercrime economy... Legitimate ad spend history raises account trust scores, meaning aged, active accounts can serve ads that pass platform safety checks that would reject a new attacker-created account.

The .CMD script utilizes certutil to extract an encrypted RAR archive embedded inside a malformed PDF... Next, like the previous activity, certutil is used to decode a file from the “-“ folder into a new encrypted zip archive

The PXA Stealer payload is then finally injected into browsers to target user credentials and crypto wallets, and to intercecpt targeted data when specific websites are visited.

Extraire les cookies de session... des navigateurs

The new variant of PXA Stealer will enumerate Chromium/Gecko browsers, decrypt any saved passwords, cookies, stored personally identifiable information (PII), autofill data, and any authentication tokens.

Extraire les cookies de session, mots de passe enregistrés et données de remplissage automatique des navigateurs

The PXA Stealer payload is then finally injected into browsers to target user credentials and crypto wallets, and to intercecpt targeted data when specific websites are visited.

The collected data is packaged into ZIP archives then exfiltrated to a specific Telegram bot via Cloudflare Worker relays... Prior to transferring the exfiltrated data, the stealer packages stage data into an archive using the following naming convention

Legitimate WinRar executable in the “Dots“ folder renamed picture.png is used to unpack the archive.

T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)

retrieving additional malicious components, including Windows executable payloads hosted remotely on Dropbox... There are also conditions where the malware will reach out to external sources for additional Python payloads, such as 0x0[.]st

Intégrer des outils d’accès à distance permettant le contrôle des machines infectées via des serveurs privés virtuels (VPS)

Router automatiquement les données volées vers des bots Telegram contrôlés par le groupe

The final payload, PXA Stealer, exfiltrates... to Telegram channels via automated bot networks... The collected data is packaged into ZIP archives then exfiltrated to a specific Telegram bot via Cloudflare Worker relays.

This campaign exemplifies a growing trend in which legitimate infrastructure (e.g., Telegram, Cloudflare Workers, Dropbox) is weaponized at scale... Data is exfiltrated to Telegram via connection via Cloudflare workers.