Back Socprime

NWHStealer Spreads via Fake Proton VPN and Game Mods

Socprime • April 16, 2026

A Windows infostealer known as NWHStealer is spreading through fake VPN download pages, bundled hardware utilities, mining tools, and compromised gaming mods. The malware is typically delivered in malicious ZIP archives that rely on self-injection, DLL hijacking, and process hollowing, with RegAsm frequently used as the target process. Once executed, NWHStealer steals browser credentials, collects cryptocurrency wallet data, and exfiltrates the stolen information through encrypted command-and-control channels.

Researchers identified two primary delivery methods. In one, malicious ZIP archives hosted on a free web-hosting platform launched the stealer through self-injection. In the other, fake Proton VPN websites delivered a DLL-based loader that abused DLL hijacking. The loader then decrypted embedded resources, hollowed out a RegAsm process, and finally executed NWHStealer in memory or injected it directly into browser-related processes.

Users should avoid downloading software from untrusted sources, including unofficial GitHub releases, suspicious SourceForge pages, and links shared through YouTube descriptions. Organizations should verify digital signatures before execution, use endpoint security tools that block known malicious URLs, and watch for suspicious scheduled tasks or hidden directories created within user profile paths.

Defenders should hunt for known NWHStealer DLL names, RegAsm process injection activity, hidden folders under LOCALAPPDATA , and scheduled tasks that launch binaries disguised as legitimate system files. The identified command-and-control domains and Telegram dead-drop link should be blocked immediately. Any affected systems should be isolated and investigated through full forensic analysis.

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NWHStealer Malware Campaign Exploits Trust in Fake VPNs and Game Mods A new malware campaign is distributing the NWHStealer trojan, targeting Windows systems through deceptive fake VPN installers, gaming mods, and hardware utility tools. Unlike traditional phishing methods, this campaign leverages users' trust in popular software to deliver its malicious payloads. The malware is disguised as legitimate installers for tools like Proton VPN and others, making it difficult for users to detect the threat. The attack is ongoing, with a focus on exploiting well-known applications to gain access to sensitive information. Users of these fake installers are at risk of having their data stolen. The full scope of the impact is still being assessed, but the campaign has raised significant concerns among cybersecurity experts. Current status indicates that the malware is actively spreading, and users are advised to exercise caution when downloading software from unofficial sources. 3 sources 65

Extracted Entities

NWHStealer Spreads via Fake Proton VPN and Game Mods

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (6)

Platforms (1)

Tools (1)