New PXA Stealer targets government and education sectors for sensitive information

Cisco Talos describes an active campaign using a Python-based information stealer called PXA Stealer, distributed via a Rust loader inside malicious ZIP attachments. The malware decrypts browser master keys (Chrome/Chromium and Firefox), extracts credentials, cookies, credit card and wallet data, Discord tokens, and other application data, then compresses and exfiltrates victims' data to attacker-controlled Telegram bots; Talos also documents attacker infrastructure (tvdseo.com), Telegram accounts/channels used for selling tools and credentials, detailed infection and persistence mechanisms, and provides IOCs for detection and mitigation.