Tag: pxa stealer

3 Attack Reports | 0 Vulnerabilities

Attack reports

From infostealer to full RAT: dissecting the PureRAT attack chain

An investigation into what appeared at first glance to be a “standard” Python-based infostealer campaign took an interesting turn when it was discovered to culminate in the deployment of a full-featured, commercially available remote access trojan (RAT) known as PureRAT.

Published: October 10, 2025

Downloadable IOCs: 7

A Vietnamese threat actor's shift from PXA Stealer to PureRAT

A Vietnamese threat actor has transitioned from using the PXA Stealer to deploying PureRAT, a commercial remote access trojan. The attack chain involves multiple stages, including phishing emails, Python-based infostealers, and .NET loaders. The campaign demonstrates a progression in complexity, ut…

remote access trojan

vietnamese threat actor

Published: October 10, 2025

Downloadable IOCs: 4

Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem

SentinelLABS and Beazley Security uncovered a series of infostealer campaigns delivering the Python-based PXA Stealer. The malware, which first appeared in late 2024, has evolved to incorporate sophisticated anti-analysis techniques and a hardened command-and-control infrastructure. Over 4,000 uniq…

credential harvesting

Published: August 4, 2025

Downloadable IOCs: 5

Click here to see more Attack Reports