NWHStealer Delivery Chain Adds Anti-VM Checks and Encrypted C2 Traffic

This report describes active campaigns delivering NWHStealer, a Rust-built info-stealer that exfiltrates browser credentials and crypto-wallet data; actors are now packaging obfuscated JavaScript with the Bun runtime (and a fallback self-injection loader) to evade analysis, perform anti-VM checks, and establish encrypted C2 communications — several C2 domains are provided as indicators.