Fake VPN Sites Deliver Infostealers

This report documents a campaign that lures users with fake VPN download sites (nordfreevpn.com and vpn4test.net) whose installers act as loaders to retrieve and execute infostealers and RATs (Grand Stealer, Azorult, Masad Stealer, Parasite RAT, and NukeBot). The analysis details loader deobfuscation and in-memory execution, stolen data types (browser credentials, cookies, crypto wallets, FTP/RDP, Telegram sessions, screenshots, desktop files), C2 mechanisms (websockets, HTTP, Telegram bot), and provides IOCs including domains, IPs, URLs, and file hashes for blocking and investigation.