A PXA Stealer campaign that works through LinkedIn interactions has been found to be active, targeting jobseekers in the US, Sweden, Bangladesh, India, and the Netherlands.

LinkedIn is popular among recruiters, and for jobseekers, its ease of use and semi-automatic application options make it an attractive place to look for work. Features like CV/resumé storage and ‘Easy Apply’ options mean it’s relatively simple to fire off several dozen job applications in a couple of hours. Receiving a response from an ’employer’, therefore, is easily acted on without much fact-checking by the would-be employee.

In the latest malware incident, users get contacted about possible employment and are directed to a Google Form, from where they’re taken by shortened URL to an archive on Dropbox. Using household name services increases the level of trust the victim places in the process, researchers state.

Materials pertaining to the bogus role are then downloaded from Dropbox and are executed on the victim’s Windows operating system. The malware loads an artificially-enlarged DLL file which replaces a legitimate component of the OS. Of the security platforms that a user might have installed on their computer, some skip the inspection of large files to prevent the machine from being slowed down by troublesomely-lengthy file scans.

A now-running batch script extracts further components into a directory that mimics a directory path used by the OS-mandated Microsoft Edge browser, and persisted via a scheduled task that’s named to resemble one of the updates which habitually and commonly run outside of user control on Windows. Rather than the payload being written to disk (which can trigger alerts from security platforms), the Python code’s core logic is executed in-memory.

Command and control infrastructure is retrieved from a Telegram channel, which then exfiltrates data to a server over encrypted TLS. Data taken includes browser credentials, session cookies (the persistence of which can bypass MFA), cryptocurrency wallets, hardware wallet data, and authentication tokens.

Once a LinkedIn account is compromised, the malware distributes itself, via sending similar messages on LinkedIn to the original victim’s contacts.

PXA Stealer was first documented in late 2024, when it used direct phishing and much simpler Telegram-based exfiltration. By mid-2025, authors had added various layers of obfuscation, command and control mechanisms, and the in-memory execution element. Vietnamese authorities have linked the most recent PXA Stealer campaign to a criminal group in the country, stating there are likely to have been tens of thousands of compromised systems.