en
PXAStealerPXA Stealer (also known as PXAStealer) is an information-stealing malware family. PXA Stealer targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, VPN and FTP client configurations and Documents matching specific filename patterns. As of 11/10/2026, CyStack's research records 3 variants, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
PXA Stealer is a Vietnamese-origin info-stealer. Its
system_info.txt uses a Vietnamese header
(Thông tin hệ thống) and snake_case keys lifted from WMI /
Win32 API names, making the fingerprint visually distinctive
even before content matches.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
3 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
d85d1bf... | 1 | High |
fb40413... | 108,363 | High |
ffefe59... | 606 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
IP: <value>Country: <value>Username: <value>AntiVirus: <value>Data Information: <value>
