New PXA Stealer Malware Targets Banks, Uses Telegram to Exfiltrate Data

CyberProof reports an 8–10% rise in PXA Stealer campaigns in Q1 2026 targeting financial firms; the malware is distributed via convincing phishing emails and malicious ZIPs (e.g., Pumaproject.zip), establishes persistence via registry entries, renames itself (svchost.exe), stores components in a hidden Dots folder (password: shodan2201), harvests browser credentials and crypto keys, and exfiltrates stolen data to Telegram channels (using BOT_ID Verymuchxbot); recommended defenses include skepticism toward unsolicited archives, monitoring suspicious domains (.xyz/.shop), and blocking unexpected .vbs/.js files.