CyberProof MDR analysts and threat researchers have identified a significant surge in PXA Stealer activity targeting global financial institutions during the first quarter of 2026.
These campaigns primarily leverage phishing emails containing malicious URLs that trigger the download of compromised ZIP attachments.
Threat actors have demonstrated high adaptability by using diverse lures, ranging from fake resumes and Adobe Photoshop installers to tax forms and legal documents.
Following the 2025 law enforcement takedowns of major infostealers such as Lumma, Rhadamanthys, and RedLine, PXA Stealer activity has filled the resulting vacuum and grown by an estimated 8 to 10 percent.
Technical Analysis Of The Infection Chain
The attack begins when a user is tricked into downloading a malicious archive file named “Pumaproject.zip” from a suspicious domain.
When the victim executes the contained executable, the next stage of the attack launches by unpacking a Python interpreter, along with various Python libraries and scripts.
The attack utilizes a Microsoft Word document to sideload a benign file while simultaneously executing a series of living-off-the-land binaries (LOLBins) and file operations.
During this phase, the core PXA Stealer component files are extracted, and a hidden directory named “Dots” is created on the victim’s machine.
Inside this hidden “Dots” folder, attackers employ the built-in Windows “Certutil” tool to decode a file into a new encrypted ZIP archive, deceptively named with a PDF extension as “Shodan.pdf”.
Subsequently, a legitimate WinRAR executable disguised as an image file named “picture.png” is used to unpack this archive using the specific password “shodan2201”.
The extracted contents are then stored in a new public directory. This second archive contains a portable Windows Python interpreter and a heavily obfuscated Python script.
To further evade detection, the Python interpreter is renamed to “svchost.exe” before launching the script. The script connects to the specific bot ID “Verymuchxbot” or “Ken1”. It injects the final PXA Stealer payload into the victim’s web browsers.
The malware intercepts targeted data when specific websites are visited, exfiltrates the stolen data through Telegram, and achieves persistence by adding a registry run key value.
| Indicator Type | Value | Description |
|---|---|---|
| File Name | Pumaproject.zip | Initial malicious archive |
| SHA256 Hash | 100a7674ece92dae0dc0bfde15dfb524939a8dd0c295ff2e232895a07e21342f | Pumaproject.zip hash |
| File Name | Document.docx | Document used for sideloading |
| SHA256 Hash | d30a4d0249b5417af02a4e7ffb5b456efd8cd5eb8da6532329ae071f643e5079 | Document.docx hash |
Indicators Of Compromise and Defenses
Security teams must remain vigilant for specific indicators and behaviors to detect and mitigate this attack. Defenders should watch for emails with suspicious URLs and archive attachments, especially those with filenames containing ‘invoice’ or ‘payment’.
It is critical to monitor the execution of script files launched from temporary folders or email content directories.
Cyber Proof Organizations should also block outbound connections to suspicious top-level domains like .shop, .xyz, .info, and .net, while actively reviewing endpoint alerts related to process injection.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
