Back Gbhackers

Phishing ZIP Files Used to Deploy PXA Stealer Targeting Financial Firms

Gbhackers •Mayura Kathir • March 27, 2026

A sharp rise in PXA Stealer campaigns targeting global financial institutions during the first quarter of 2026. The activity marks a notable shift in the infostealer landscape, with PXA Stealer filling the gap left by the takedowns of major malware families such as Lumma, Rhadamanthys, and RedLine in 2025. Researchers estimate that PXA Stealer activity […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PXA Stealer Malware Targets Financial Institutions via Phishing ZIP Files A surge in cyberattacks utilizing PXA Stealer malware has been reported, primarily targeting financial institutions globally. This increase follows the dismantling of major infostealer operations such as Lumma, Rhadamanthys, and RedLine in 2025, which has left a gap in the malware landscape. PXA Stealer is being deployed through phishing ZIP files, making it a significant threat to organizations handling sensitive financial data. Researchers have noted a sharp rise in these campaigns during the first quarter of 2026, indicating a shift in tactics among cybercriminals. Financial firms are urged to enhance their security measures to combat this evolving threat. The current status shows that PXA Stealer is actively being used in the wild, necessitating immediate attention from cybersecurity professionals. 2 sources 65

Extracted Entities

Phishing ZIP Files Used to Deploy PXA Stealer Targeting Financial Firms

The full story

Extracted Entities

Attack Types (2)

Industries (1)

Malware (4)

MITRE ATT&CK (1)