PXA Stealer Campaign Uses LinkedIn Recruiter Lures to Target Professionals
Summary
Cyble researchers attribute a multi-stage PXA Stealer campaign to Vietnam-linked actors using fake LinkedIn recruiters, Google Forms and DLL sideloading. The malware steals credentials and wallet data; researchers estimate more than 94,000 systems were infected.
Key points
- Cyble researchers attribute the campaign to Vietnam-linked actors targeting job seekers and professionals in several countries.
- The reported lure uses compromised or spoofed LinkedIn recruiter accounts posing as Apex Logistics Group, followed by a Google Form and a cloud-hosted ZIP.
- The ZIP contains a Word executable that loads a malicious DLL through sideloading; researchers say the DLL is padded to roughly 100 MB to evade scanners that skip oversized files.
- PXA Stealer reportedly runs in memory, steals browser credentials, cookies, session tokens, crypto wallet identifiers, 2FA secrets, and desktop and email client credentials.
- The malware reportedly establishes persistence through scheduled tasks disguised as system updates and exfiltrates data through encrypted Telegram channels.
- Researchers estimate more than 94,000 infected systems worldwide; the article also reports hundreds of thousands of unique passwords and millions of browser cookies stolen.
Article Details
- Attack Vectors
- The campaign used compromised or spoofed LinkedIn recruiter accounts posing as Apex Logistics Group to contact job seekers and professionals.
- Targets were asked to complete a Google Form and then redirected through a URL shortener to a cloud-hosted ZIP containing a job-themed Microsoft Word executable.
- Launching the executable triggered DLL sideloading; the malicious DLL was padded to roughly 100 MB, and PXA Stealer executed in memory.
- PXA Stealer harvested browser credentials, cookies, session tokens, cryptocurrency wallet identifiers, two-factor authentication secrets, and desktop and email client credentials.
- The malware established persistence with scheduled tasks disguised as system updates, including a bogus Microsoft Edge update, and exfiltrated data through encrypted Telegram channels.
- Defensive Notes
- The article recommends employee training, endpoint protection, multifactor authentication, and monitoring for unusual activity.
MITRE ATT&CK
T1027.001 · Binary PaddingThe actors padded the malicious DLL to roughly 100 MB to evade scanners that skip oversized files.T1041 · Exfiltration Over C2 ChannelThe article reports stolen data exfiltration through encrypted Telegram channels and hidden command-and-control infrastructure.T1053.005 · Scheduled TaskPXA Stealer persistence was established through scheduled tasks disguised as system updates.T1204.002 · Malicious FileTargets were induced to launch a job-themed Microsoft Word executable inside the downloaded ZIP.T1539 · Steal Web Session CookieThe malware collected browser cookies and session tokens from victim systems.T1555.003 · Credentials from Web BrowsersPXA Stealer harvested stored browser login credentials.T1566.003 · Spearphishing via ServiceThe actors used LinkedIn direct messages posing as recruiter outreach to lure targets into the infection chain.T1574.002 · DLL Side-LoadingThe malicious DLL was loaded through a DLL sideloading sequence initiated by the executable.
Malware
Vendors
Products
Google formsThe multiâstage operation leverages Google Forms, URL shorteners, cloudâhosted ZIPs with oversized DLLs, DLL sideloading and memoryâonly execution, and exfiltration over encrypted Telegram channels, enablingLinkedInA newly exposed global campaign shows Vietnamâlinked actors using LinkedIn and spoofed recruiter accounts such as Apex Logistics Group to distribute PXA Stealer and siphon credentials, crypto wallet data, and otherMicrosoft EdgePersistence is established through scheduled tasks disguised as standard system updates, such as a bogus Microsoft Edge update, blending malicious activity into normal operations.Microsoft Wordon cloud storage. That file, labeled with a jobârelated name, contains a seemingly legitimate Microsoft Word executable that initiates a DLL sideloading sequence once launched. This technique allows theTelegramZIPs with oversized DLLs, DLL sideloading and memoryâonly execution, and exfiltration over encrypted Telegram channels, enabling largeâscale account compromise and regulatory and reputational risk for victims.
Countries
BangladeshThese Vietnamâlinked actors target job seekers and professionals in India, Bangladesh, Sweden, the Netherlands, and the United States, exploiting trust in professional outreach to propagate their malware at scale.IndiaThese Vietnamâlinked actors target job seekers and professionals in India, Bangladesh, Sweden, the Netherlands, and the United States, exploiting trust in professional outreach to propagate their malware at scale.NetherlandsThese Vietnamâlinked actors target job seekers and professionals in India, Bangladesh, Sweden, the Netherlands, and the United States, exploiting trust in professional outreach to propagate their malware at scale.SwedenThese Vietnamâlinked actors target job seekers and professionals in India, Bangladesh, Sweden, the Netherlands, and the United States, exploiting trust in professional outreach to propagate their malware at scale.United StatesThese Vietnamâlinked actors target job seekers and professionals in India, Bangladesh, Sweden, the Netherlands, and the United States, exploiting trust in professional outreach to propagate their malware at scale.VietnamCybersecurity researchers at Cyble have mapped the multiâstage attack chain, attributing the PXA Stealer campaign with a high degree of confidence to cybercriminals operating from Vietnam.