New NWHStealer Delivery Chain Uses Bun Loader, Anti-VM Checks, and Encrypted C2

Cybersecuritynews •Tushar Subhra Dutta • May 8, 2026

A new and evolving threat has caught the attention of cybersecurity researchers worldwide. A Windows-based information stealer known as NWHStealer has resurfaced with a more sophisticated delivery chain, now using the Bun JavaScript runtime as part of its infection process. This shift makes it clear that the attackers behind this campaign are actively experimenting with […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NWHStealer Malware Campaign Evolves with Bun Loader and Anti-VM Techniques The NWHStealer infostealer has adopted a new distribution method utilizing the Bun JavaScript runtime, enhancing its delivery infrastructure. This Rust-based malware targets Windows systems, leveraging Bun's performance to package malicious code effectively. The threat actors are employing anti-VM checks to evade detection and analysis, indicating a sophisticated approach to malware deployment. The campaign signifies a shift in tactics, as attackers experiment with emerging technologies to bypass traditional security measures. The full scope of the impact is still being assessed, but the use of encrypted command and control (C2) channels raises concerns about data exfiltration. Cybersecurity researchers are actively monitoring the situation as it develops. 2 sources 70

Extracted Entities

New NWHStealer Delivery Chain Uses Bun Loader, Anti-VM Checks, and Encrypted C2

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)