Phishing ZIP Files Used to Deploy PXA Stealer Targeting Financial Firms

A sharp rise in PXA Stealer campaigns targeting global financial institutions during the first quarter of 2026.

The activity marks a notable shift in the infostealer landscape, with PXA Stealer filling the gap left by the takedowns of major malware families such as Lumma, Rhadamanthys, and RedLine in 2025.

Researchers estimate that PXA Stealer activity has increased by nearly 8–10% as threat actors rapidly adapt to the evolving ecosystem.

The attacks primarily begin with phishing emails containing malicious links that lead victims to download ZIP archives.

These archives are often disguised using convincing lures such as job applications, tax documents, legal files, or software installers like Adobe Photoshop.

In one investigated case, a victim downloaded a file named “Pumaproject.zip” from a suspicious domain.

CyberProof MDR analysts and Threat Researchers have identified a significant surge in PXA Stealer activity targeting global financial institutions.

Inside the archive, an executable named “Document.docx.exe” tricked the user into launching the infection chain. This technique relies on double file extensions to appear legitimate while executing malicious code.

Phishing ZIP Files

Once executed, the malware initiates a complex, multi-stage attack. It unpacks a hidden directory containing a Python interpreter, supporting libraries, and scripts.

A decoy Word document is displayed to avoid suspicion, while malicious processes run in the background.

The attackers use Living-off-the-Land Binaries (LOLBins) to evade detection. For example, the Windows utility certutil.exe is used to decode hidden payloads into an encrypted archive disguised as a PDF file.

A renamed WinRAR executable, masquerading as “picture.png,” is then used to extract the archive.

The payload is deployed into a directory such as “C:\Users\Public\WindowsSecure,” using a password-protected archive. Inside, the Python interpreter is renamed to “svchost.exe” to blend in with legitimate system processes.

The renamed interpreter executes an obfuscated Python script, often disguised as an image file. This script references a Telegram bot identifier such as “Verymuchxbot,” which is used for command-and-control communication.

Once active, PXA Stealer injects itself into web browsers to harvest sensitive data. This includes saved credentials, browsing sessions, and cryptocurrency wallet information. It can also intercept user activity on targeted websites in real time.

Stolen data is then exfiltrated through Telegram channels, highlighting the growing use of legitimate platforms for covert data transfer. The malware also establishes persistence by modifying Windows registry entries, ensuring it remains active after system reboots.

These include variations in folder names, payload delivery techniques, and bot identifiers. This adaptability allows attackers to bypass signature-based detection and maintain operational effectiveness.

Legitimate WinRar executable in the “Dots“ folder renamed picture.png is used to unpack the archive.

While the overall kill chain resembles earlier PXA Stealer campaigns reported in 2025, CyberProof researchers observed subtle changes.

The opportunistic nature of the lures suggests that attackers are not targeting specific roles but casting a wide net across financial organizations, increasing the likelihood of successful compromise.

Mitigations

Security teams are advised to closely monitor for suspicious email attachments, especially ZIP or RAR files with misleading names.

Execution of scripts such as VBS, VBE, or JavaScript from temporary or email directories should be treated as high risk.

Organizations should also watch for unusual process behavior, including process injection and the execution of renamed binaries like svchost.exe from non-standard locations.

Outbound connections to uncommon domains such as “.xyz” or “.shop” should be investigated, particularly when linked to file downloads.

Additionally, monitoring traffic to messaging platforms like Telegram can help detect data exfiltration attempts.

Keeping threat intelligence feeds updated and proactively hunting for indicators associated with PXA Stealer can significantly improve defense against these campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.