Fake ProtonVPN, game mod sites spread NWHStealer in new Windows malware campaign

Gbhackers •Mayura Kathir • April 16, 2026

Multiple ongoing malware campaigns are distributing a powerful information-stealing trojan, tracked as NWHStealer, through fake VPN installers, gaming mods, and system tools. Unlike typical phishing campaigns, these attacks exploit users’ trust in popular software. Threat actors are disguising malicious payloads as legitimate installers for tools such as Proton VPN, OhmGraphite, Sidebar Diagnostics, Pachtop, and HardwareVisualizer. The files are hosted […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NWHStealer Malware Campaign Exploits Trust in Fake VPNs and Game Mods A new malware campaign is distributing the NWHStealer trojan, targeting Windows systems through deceptive fake VPN installers, gaming mods, and hardware utility tools. Unlike traditional phishing methods, this campaign leverages users' trust in popular software to deliver its malicious payloads. The malware is disguised as legitimate installers for tools like Proton VPN and others, making it difficult for users to detect the threat. The attack is ongoing, with a focus on exploiting well-known applications to gain access to sensitive information. Users of these fake installers are at risk of having their data stolen. The full scope of the impact is still being assessed, but the campaign has raised significant concerns among cybersecurity experts. Current status indicates that the malware is actively spreading, and users are advised to exercise caution when downloading software from unofficial sources. 3 sources 65

Extracted Entities

Fake ProtonVPN, game mod sites spread NWHStealer in new Windows malware campaign

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (5)