Professional Networks Under Attack: Vietnam-Linked Actors Deploy PXA Stealer in Global Infostealer Campaign

Technical Analysis of PXA Stealer Campaigns

Initial Access: LinkedIn Phishing

The threat actors initiate their attack by sending phishing emails or direct messages (DMs) through compromised LinkedIn accounts. These DMs impersonate recruiters and offer job opportunities to lure victims into clicking on malicious links.

Example Scenario:

• Phishing Email/LinkedIn Message: The message typically includes a link that directs the victim to a Google Form.
• Google Form: After filling out the form, the victim is redirected to a shortened URL.
• Shortened URL: This URL leads to a Dropbox link containing a password-protected ZIP archive.

Payload Delivery

Payload Structure:

1. Dropbox Archive: The payload is delivered via a Dropbox link that contains a password-protected ZIP file.
2. ZIP File Contents: Inside the ZIP file, there are several files including:
   • A hidden folder with staged payloads.
   • An image file (e.g., image.png) which is actually a renamed WinRAR archive.

Example:

plaintext
 
1Dropbox Link -> password-protected.zip
2Inside zip:
3  - Hidden Folder
4  - image.png (WinRAR)

Execution

1

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.