NWHStealer is a Windows infostealer actively distributed through diverse platforms such as fake Proton VPN websites, GitHub, GitLab, MediaFire, SourceForge, and YouTube links. It targets browser data, saved passwords, and cryptocurrency wallets (over 25 types). Two main infection methods are identified: one involves malicious ZIP files hosted on free web hosting providers containing self-injection loaders; the other uses fake websites employing DLL hijacking to inject malicious code into the RegAsm process. The malware exfiltrates data encrypted with AES-CBC to command-and-control servers and maintains persistence via scheduled tasks and UAC bypass techniques. Indicators include specific malicious domains and file hashes. There is no known official patch or vendor advisory for remediation.

The malware compromises user privacy and security by stealing browser data, saved passwords, and cryptocurrency wallet information, potentially leading to financial theft and unauthorized account access. Its use of multiple infection vectors and persistence mechanisms increases the risk of successful compromise. The encrypted exfiltration of data to attacker-controlled servers complicates detection and response. No known exploits in the wild beyond these campaigns have been reported.

No official patch or vendor advisory is available for this threat. Mitigation should focus on user education to avoid downloading software from untrusted or fake websites, especially those impersonating legitimate services like Proton VPN. Monitoring for suspicious scheduled tasks and DLL hijacking attempts may help detect infection. Employing endpoint protection solutions capable of detecting known indicators such as the provided domains and file hashes is recommended. Regularly updating software and applying security best practices can reduce exposure to such threats.