From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

The article from Malwarebytes discusses a sophisticated Windows infostealer named NWHStealer that is being spread through various methods, including fake Proton VPN websites and gaming mods. Here are the key points:

Methods of Distribution:

1. Fake Websites: The malware spreads via fake Proton VPN setup pages (e.g., vpn-proton-setup[.]com).
2. GitHub and SourceForge: Malicious versions of software tools are uploaded to platforms like GitHub and SourceForge.
3. YouTube Links: Downloads from links in YouTube video descriptions.

Infection Chain:

1. Initial Download: Users download infected archives from trusted or fake websites.
2. DLL Injection: The malware injects a DLL into processes like RegAsm.exe for execution.
3. Process Hollowing: Uses low-level APIs to perform process hollowing and execute payloads in memory.

Payload: NWHStealer

• Data Collection: Enumerates cryptocurrency wallets, browser data, saved passwords, and other sensitive information.
• Injection into Browsers: Injects a DLL into browser processes (e.g., msedge.exe, firefox.exe) to extract and exfiltrate data.
• **Encryption

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.