From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

This report describes multiple active campaigns distributing NWHStealer, an infostealer that harvests browser data, saved passwords, and cryptocurrency wallet files. Attackers distribute malicious archives via fake VPN websites, code- and file-hosting platforms, compromised YouTube links, and free web hosting (onworks.net), using loaders such as MSI/Node.js, DLL hijacking, process hollowing (RegAsm), in-memory execution, and a CMSTP UAC bypass; the report includes hashes, domains, URLs, and mitigation recommendations.