NWHStealer Campaign Deploys Bun Loader, Anti-VM Evasion, and Encrypted C2

Gbhackers •Mayura Kathir • May 8, 2026

A new distribution method for the NWHStealer infostealer that leverages the Bun JavaScript runtime, marking a significant evolution in the malware’s delivery infrastructure. The threat actors behind this Rust-based stealer are exploiting Bun’s relative newness and high-performance capabilities to package malicious code into larger executables that evade traditional detection methods. Bun is a legitimate, fast […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NWHStealer Malware Campaign Evolves with Bun Loader and Anti-VM Techniques The NWHStealer infostealer has adopted a new distribution method utilizing the Bun JavaScript runtime, enhancing its delivery infrastructure. This Rust-based malware targets Windows systems, leveraging Bun's performance to package malicious code effectively. The threat actors are employing anti-VM checks to evade detection and analysis, indicating a sophisticated approach to malware deployment. The campaign signifies a shift in tactics, as attackers experiment with emerging technologies to bypass traditional security measures. The full scope of the impact is still being assessed, but the use of encrypted command and control (C2) channels raises concerns about data exfiltration. Cybersecurity researchers are actively monitoring the situation as it develops. 2 sources 70

Extracted Entities

NWHStealer Campaign Deploys Bun Loader, Anti-VM Evasion, and Encrypted C2

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Tools (2)