Related Threat Clusters

NWHStealer Malware Campaign Evolves with Bun Loader and Anti-VM Techniques
The NWHStealer infostealer has adopted a new distribution method utilizing the Bun JavaScript runtime, enhancing its delivery infrastructure. This Rust-based malware targets Windows systems, leveraging Bun's performance…

2 articles · Updated May 8, 2026
NWHStealer Malware Campaign Exploits Trust in Fake VPNs and Game Mods
A new malware campaign is distributing the NWHStealer trojan, targeting Windows systems through deceptive fake VPN installers, gaming mods, and hardware utility tools. Unlike traditional phishing methods, this campaign…

3 articles · Updated April 16, 2026
Threat Actors Exploit n8n Webhooks for Malware Delivery and Phishing
Cybercriminals are exploiting the n8n AI workflow automation platform to conduct phishing campaigns and deliver malware. Between October 2025 and March 2026, there was a 686% increase in phishing emails utilizing…

9 articles · Updated April 16, 2026

Recent Intelligence Reports

New NWHStealer Delivery Chain Uses Bun Loader, Anti-VM Checks, and Encrypted C2 — Cybersecuritynews · May 8, 2026
NWHStealer Campaign Deploys Bun Loader, Anti-VM Evasion, and Encrypted C2 — Gbhackers · May 8, 2026
NWHStealer Spreads via Fake Proton VPN and Game Mods — Socprime · April 16, 2026
Fake ProtonVPN, game mod sites spread NWHStealer in new Windows malware campaign — Gbhackers · April 16, 2026
Fake Proton VPN Sites and Gaming Mods Spread NWHStealer in New Windows Malware Campaign — Cybersecuritynews · April 16, 2026
Hackers Exploit n8n Webhooks to Spread Malware — Gbhackers · April 16, 2026