New NWHStealer Delivery Chain Uses Bun Loader, Anti-VM Checks, and Encrypted C2

NWHStealer is a resurfaced Rust-based Windows information stealer distributed via malicious ZIPs masquerading as game trainers or cracked software and using the Bun JavaScript runtime to load encrypted, in-memory payloads; it performs anti-VM checks, harvests browser data, passwords, crypto wallets, targets apps like Discord and Steam, persists via scheduled tasks, and uses encrypted C2 infrastructure with fallback loaders. The report includes multiple domains and SHA-256 hashes as IoCs and recommends downloading only from verified sources and verifying signatures.