From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

Reported 17 Apr 2026 by otx · Severity: medium

Multiple campaigns are distributing NWHStealer through diverse delivery methods including fake VPN downloads, hardware utilities, and gaming modifications. The malware collects browser data, saved passwords, and cryptocurrency wallet information. Distribution occurs via fake webs