Malware hides behind trusted downloads

Cyber criminals are pushing a Windows information stealer called NWHStealer through bogus software downloads that masquerade as Proton VPN installers, gaming mods and hardware utilities, in a campaign that security researchers say relies less on classic phishing and more on users searching for tools they believe are legitimate. Malwarebytes said on April 15 that it had identified multiple active distribution chains tied to the stealer, with malicious files turning up on fake websites, code-hosting platforms and file-sharing services.

The campaign matters because it exploits a basic assumption that widely used utilities, diagnostics tools and game modifications are safe if they look familiar. According to Malwarebytes, NWHStealer is being dressed up as VPN installers, hardware tools such as OhmGraphite, Pachtop, HardwareVisualizer and Sidebar Diagnostics, as well as mining software and game cheats or mods. The researchers said the malware can collect browser data, saved passwords and cryptocurrency wallet information, opening the way for account hijacking, theft and follow-on intrusions.

That approach marks a shift in emphasis rather than a wholly new tactic. Instead of leaning mainly on email bait, attackers are placing malware in files people go out of their way to find. Malwarebytes said the lures were spread through fake sites impersonating legitimate services including Proton VPN, alongside GitHub, GitLab, MediaFire, SourceForge and links promoted in gaming- and security-themed YouTube videos. The breadth of those channels suggests the operators are trying to reach both casual users and more technically confident downloaders who may be less suspicious of software obtained outside official stores.

Researchers said the stealer is not a simple grab-and-run tool. Malwarebytes described several execution methods, including self-injection and injection into other Windows processes such as RegAsm, with MSI packages or Node. js wrappers often used as the first-stage loader. In one case highlighted by the company, malicious ZIP files were hosted on pages connected to a free web-hosting provider and arrived with filenames resembling ordinary software archives. In another, fake Proton-themed sites delivered the malware through DLL hijacking and injection into RegAsm.

The technical details point to a more persistent and evasive threat than a basic password stealer. Malwarebytes said NWHStealer can inject a DLL into browser processes including Edge, Firefox and Chrome to extract and decrypt browser data before exfiltrating it to a command-and-control server. The malware also creates hidden directories under LOCALAPPDATA, adds exclusions to Windows Defender, forces a Group Policy update, schedules tasks to relaunch at user logon with elevated privileges and can retrieve replacement infrastructure through a Telegram-based dead drop if the primary control server goes offline. Data sent back to operators is encrypted with AES-CBC, according to the report.

Security coverage published on April 16 by other cyber outlets broadly echoed those findings, though much of that reporting appears derivative of the Malwarebytes research rather than the result of separate disclosure by another major vendor. That makes the core attribution and technical narrative strongest where it rests on Malwarebytes’ own analysis, while the wider reporting still reinforces that the campaign has quickly drawn industry attention.

The fake Proton angle also fits a longer pattern in which privacy and security brands are impersonated to lower a target’s guard. BleepingComputer documented a fake ProtonVPN installer campaign in 2020 used to deliver the AZORult information stealer, showing that attackers have for years understood the value of cloning a trusted VPN brand to distribute credential theft malware. The NWHStealer activity appears to update that playbook for a software ecosystem now shaped by download portals, repositories, creator channels and mod communities.

For Windows users, the lesson is less about one malware family than about software trust. Malwarebytes advised downloading software only from official sites, treating GitHub, SourceForge and file-sharing links with caution unless the source can be verified, checking signatures and publisher information before execution, and avoiding tools promoted only through video-description links. Those are familiar warnings, but this campaign underlines why they remain necessary: the infection chain begins not with a suspicious email but with a search result or download page that looks plausible enough to pass a quick visual check.