From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere
Multiple campaigns are distributing NWHStealer through diverse platforms including fake VPN downloads, hardware utilities, and gaming modifications. The infostealer collects browser data, saved passwords, and cryptocurrency wallet information. Distribution occurs via fake websites impersonating legitimate services like Proton VPN, code hosting platforms such as GitHub and GitLab, file hosting services including MediaFire and SourceForge, and links from YouTube videos. Two primary infection methods are analyzed: one using a free web hosting provider distributing malicious ZIP files with self-injection loaders, and another employing fake websites with DLL hijacking techniques that inject into the RegAsm process. The stealer targets over 25 cryptocurrency wallets and multiple browsers, exfiltrating data to command-and-control servers using AES-CBC encryption and maintaining persistence through scheduled tasks and UAC bypass techniques.
Pulse ID: 69dfb91808e1258915184d6e
Pulse Link: https://otx.alienvault.com/pulse/69dfb91808e1258915184d6e
Pulse Author: AlienVault
Created: 2026-04-15 16:13:12
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Browser #CyberSecurity #ELF #Encryption #GitHub #InfoSec #InfoStealer #OTX #OpenThreatExchange #Password #Passwords #RAT #RCE #VPN #Windows #Word #YouTube #ZIP #bot #cryptocurrency #AlienVault








