https://www.theregister.com/2025/08/04/pxa_stealer_4000_victims/
https://www.sentinelone.com/labs/ghost-in-the-zip-new-pxa-stealer-and-its-telegram-powered-ecosystem/
More than 4,000 victims across 62 countries have been infected by stealthy infostealers pilfering people’s passwords, credit card numbers, and browser cookies, which are then sold to other criminals on Telegram-based marketplaces. South Korea, the US, the Netherlands, Hungary, and Austria have been the hardest-hit countries in this ongoing campaign, according to SentinelLabs and Beazley Security, which detailed their findings in a Monday report and said the final payload delivers the Python-based PXA Stealer. …
Regards