LinkedIn Job Seekers Targeted by Sophisticated “PXA Stealer” Campaign

A financially motivated campaign attributed to a Vietnam-based cybercriminal group uses compromised LinkedIn accounts and fraudulent recruitment messages to distribute the PXA Stealer. The multi-stage attack funnels victims through Google Forms, shortened URLs, and Dropbox-hosted ZIPs containing a large (~100 MB) DLL that is sideloaded by winword.exe; the payload executes in memory, exfiltrates browser credentials, session cookies (enabling MFA bypass), cryptocurrency wallet data and 2FA artifacts, retrieves C2 from an encrypted Telegram channel, and persists via a scheduled task mimicking a Microsoft Edge update.