Back Cybersecuritynews

Hackers Use Phishing ZIP Files to Deploy PXA Stealer Against Financial Firms

Cybersecuritynews •Tushar Subhra Dutta • March 27, 2026

A new wave of cyberattacks is putting financial institutions on high alert, as threat actors ramp up the use of PXA Stealer — a powerful information-stealing malware — against organizations worldwide. The surge follows law enforcement’s successful dismantling of major infostealer operations, including Lumma, Rhadamanthys, and RedLine, throughout 2025. With those platforms gone, PXA Stealer […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PXA Stealer Malware Targets Financial Institutions via Phishing ZIP Files A surge in cyberattacks utilizing PXA Stealer malware has been reported, primarily targeting financial institutions globally. This increase follows the dismantling of major infostealer operations such as Lumma, Rhadamanthys, and RedLine in 2025, which has left a gap in the malware landscape. PXA Stealer is being deployed through phishing ZIP files, making it a significant threat to organizations handling sensitive financial data. Researchers have noted a sharp rise in these campaigns during the first quarter of 2026, indicating a shift in tactics among cybercriminals. Financial firms are urged to enhance their security measures to combat this evolving threat. The current status shows that PXA Stealer is actively being used in the wild, necessitating immediate attention from cybersecurity professionals. 2 sources 65

Extracted Entities

Hackers Use Phishing ZIP Files to Deploy PXA Stealer Against Financial Firms

The full story

Extracted Entities

Attack Types (2)

Industries (1)

Malware (4)

MITRE ATT&CK (1)