In Q3 2025, over 200,000 passwords, hundreds of credit card records, and more than 4 million browser cookies were harvested by the PXA Stealer campaign.