Top Tweets for #PXAStealer
LinkedIn job seekers are being targeted by a sophisticated Vietnam-based group using PXA Stealer. This 100MB malware bypasses MFA and drains crypto wallets.
#PXAStealer #LinkedInScam #CyberSecurity #InfoSec #MalwareAlert #JobSearch #CryptoTheft
https://t.co/qjqJnzWrMl
PXA Stealer activity surges in Q1 2026, targeting global finance. Learn how this Python-based malware uses Telegram and LOLBins to hijack crypto and banking data.
#PXAStealer #Malware2026 #CyberSecurity #InfoSec #CryptoSecurity #FinancialThreats
https://t.co/NB8gsaEFiJ
Cyble dissects a LinkedIn job‑lure campaign, exposing its multi‑stage PXA Stealer tactic that hijacks accounts and steals sensitive data.
https://t.co/hXU7DlXtyZ
#Infostealer #malware #LinkedIn #PXAStealer #ThreatIntel
PXA Stealer attacks are rising, with researchers reporting a 10% spike targeting financial firms. The malware uses phishing and Telegram to steal credentials and crypto data.
Read: https://t.co/x3m3eaSiGC
#CyberSecurity #Malware #Infostealer #PXAStealer
🚨 #PXAStealer continues to evolve
Hitting government, education, and private users, it steals sensitive data via DLL sideloading and decoy legitimate files
👨💻 See overview of its methods and anti-analysis techniques: https://t.co/98Lvdr1RKr
🚨 How #Pxastealer Uses Masquerading: Execution Flow and TTPs.
⚠️ Pxastealer is delivered through archive links in #phishing emails, bypassing automated filters. Masquerading hides execution and gives attackers time to exfiltrate data.
Execution flow & TTPs:
1️⃣ Initial Access (T1566.002): A victim clicks a link to a malicious archive in a spearphishing email.
2️⃣ Execution & Cleanup (T1059.003, T1070.004): cmd.exe runs a long command chain and deletes traces.
3️⃣ Defense Evasion (1036.008, T1140, T1027): A fake Word file opens to mask background activity, while certutil -decode turns a fake “financial report” into an archive masked as Invoice.pdf. Another file posing as a .jpg unpacks the payload, hiding malicious activity behind trusted formats.
4️⃣ Execution / Masquerading (T1036.005): The attack unpacks Python files and runs Pxastealer under the name svchost.exe, using a trusted filename outside System32 to evade detection.
5️⃣ Persistence (T1547.001): Adds autorun via command line.
6️⃣ Exfiltration / C2 (T1567, T1071.001): Pxastealer exfiltrates data via Telegram.
👨💻 Examine Pxastealer behavior and collect #IOCs: https://t.co/TcS9SG4o34
🔍 Further investigate the threat, track campaigns, and enrich IOCs with live attack data:
🔹 https://t.co/yUgv3pn1dT
🔹 https://t.co/2QLVraCeRc
IOCs:
Sha256: 81918ea5fa5529f04a00bafc7e3fb54978a0b7790cfc7a5dad9fa9640666560a (svchost.exe)
🚀 Gain full visibility with #ANYRUN to make faster, smarter security decisions.
#ExploreWithANYRUN #CybersecurityAwarenessMonth
Vietnamese Hackers Use PXA Stealer, Hit 4,000 IPs and Steal 200,000 Passwords Globally https://t.co/fZdsgVC82j #Cybersecurity #DataBreach #Hacking #PXAstealer #Malware
SentinelLABS and Beazley expose PXA Stealer, a Python-based infostealer campaign targeting 62 countries with stealthy DLL sideloading, decoy files, and Telegram-based data exfiltration.
#PXAstealer #Infostealer #DLLsideloading #Cybersecurity
https://t.co/Mr75093KV6
#pxastealer 🇻🇳 targeting 🇮🇹
@TalosSecurity @malware_traffic @CertLu @AgidCert @guelfoweb @JAMESWT_WT @malwrhunterteam
H/t: @skocherhan
#malspam delivers #remcos rat to 🇮🇹
vt:c50b5e77227fea5243ae85d37e8a308d
mb:4864a55cff27f686023456a22371e790
vt:91e8261fc4590d9705e64caf444dccbf
There also is an obf file inside the python runtime with a weird "TUOI_LON_DECODE" (a troll from TA?)
@JAMESWT_WT
Last Seen Hashtags on Sotwe
nolimit #teenage #brother
Seen from Lebanon
tightcock
Seen from United States
gayhairylegs
Seen from United States
EbonyBBW
Seen from United States
neganandmaggie
Seen from United States
minichat() +filter:native_video
Seen from Netherlands
pussyprint
Seen from United States
fishnetsocks
Seen from Turkey
anal accidentally
Seen from United States
brosis
Seen from France
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
240.9M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers