Bidirectional communication via polyrhythms and shuffles: Without Jon the beat must go on

Cisco Talos reports an active information-stealing campaign (PXA Stealer) attributed to a Vietnamese-speaking threat actor targeting government and education organizations in Europe and Asia; the malware harvests credentials, VPN/FTP data, browser cookies and can decrypt browser master passwords to exfiltrate stored credentials. Talos published Snort rules and ClamAV signatures to detect and defend against PXA Stealer; the newsletter also highlights related telemetry (malware hashes) and other security headlines including malicious NPM packages and a Palo Alto Networks firewall vulnerability.