NWHStealer Distributed Through Fake Proton VPN Pages and Malicious Gaming Mods

The report details a widespread NWHStealer campaign that disguises an information stealer as legitimate software (VPN installers, hardware utilities, gaming mods) and distributes it via code repositories, file‑hosting services, and a fake Proton VPN site promoted through compromised YouTube channels. Technical analysis describes DLL hijacking, resource decryption, process hollowing, browser DLL injection to harvest saved credentials and cryptocurrency wallets, AES‑CBC exfiltration to C2, and persistence/UAC bypass techniques; recommended mitigations include downloading only from official vendors, verifying signatures, and avoiding untrusted file sources.