Vietnamese High School Student Indicted for Engineering Malware Used to Infect 94,000 Computers Globally

A 12th grader in Vietnam has been indicted for creating "PXA Stealer" malware that infected 94,000 computers across Europe, Asia, and the Americas.

By: AXL Media

Published: Apr 7, 2026, 3:44 AM EDT

Source: Information for this report was sourced from VnExpress

The Rise of a Teenage Cyber Architect

A high school senior from Hac Thanh Ward has been identified as the primary developer behind a series of high-potency malware strains used in a global cybercrime operation. According to provincial police, the student began coding malicious software in 2024 while still in the 11th grade, utilizing Python and C++ to create tools capable of bypassing standard operating system defenses. These initial programs were designed to extract saved browser passwords, login cookies, and autofill data, marking the beginning of a rapid descent into professional-grade cyber exploitation.

Strategic Partnerships with Organized Crime Syndicates

The student’s technical capabilities caught the attention of established cybercriminals, leading to a series of lucrative commissions. In July 2024, he reportedly connected with 28-year-old Le Thanh Cong, who tasked the teenager with creating malware specifically tailored for large-scale data harvesting. This partnership evolved to include 21-year-old Phan Xuan Anh, with whom the student co-developed "PXA Stealers," a sophisticated malware variant. This new strain went beyond simple data theft, granting operators full remote control over infected machines and automatically routing stolen information to managed Telegram bot systems.

Monetization and the Economics of Digital Theft

The financial structure of the criminal ring ensured that the teenage developer remained highly incentivized. Investigators found that the student received a 15% share of profits generated from the sale of stolen data and was paid flat fees, such as a 500 dollar payment for a specific variant named "Adonis." Beyond these base fees, he reportedly earned recurring commissions ranging from 50 to 100 dollars each time the syndicate successfully monetized data stolen via his viruses. This tiered payment system allowed the minor to profit directly from the ongoing exploitation of victims.