From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere

Reported 15 Apr 2026 by otx · Severity: medium

Multiple campaigns are distributing NWHStealer through diverse platforms including fake VPN downloads, hardware utilities, and gaming modifications. The infostealer collects browser data, saved passwords, and cryptocurrency wallet information. Distribution occurs via fake website