Fake Proton VPN Sites and Gaming Mods Spread NWHStealer in New Windows Malware Campaign

Cybersecuritynews •Tushar Subhra Dutta • April 16, 2026

A newly identified information-stealing malware called NWHStealer is quietly making its way onto Windows systems through a well-disguised campaign that uses fake VPN websites, gaming mods, and hardware utility tools as bait. The attackers are not relying on spam emails or obvious phishing tricks. Instead, they are placing malware inside files that people actively […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NWHStealer Malware Campaign Exploits Trust in Fake VPNs and Game Mods A new malware campaign is distributing the NWHStealer trojan, targeting Windows systems through deceptive fake VPN installers, gaming mods, and hardware utility tools. Unlike traditional phishing methods, this campaign leverages users' trust in popular software to deliver its malicious payloads. The malware is disguised as legitimate installers for tools like Proton VPN and others, making it difficult for users to detect the threat. The attack is ongoing, with a focus on exploiting well-known applications to gain access to sensitive information. Users of these fake installers are at risk of having their data stolen. The full scope of the impact is still being assessed, but the campaign has raised significant concerns among cybersecurity experts. Current status indicates that the malware is actively spreading, and users are advised to exercise caution when downloading software from unofficial sources. 3 sources 65

Extracted Entities

Fake Proton VPN Sites and Gaming Mods Spread NWHStealer in New Windows Malware Campaign

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)