NWHStealer is a Windows-based infostealer distributed through diverse vectors such as fake VPN download sites impersonating Proton VPN, code hosting platforms (GitHub, GitLab), file hosting services (MediaFire, SourceForge), and YouTube links. It targets sensitive user data including browser credentials, saved passwords, and cryptocurrency wallet information from over 25 wallet types. Infection occurs primarily via two methods: (1) malicious ZIP files containing self-injection loaders hosted on free web hosting providers, and (2) fake websites using DLL hijacking to inject malicious code into the RegAsm process. The malware exfiltrates data encrypted with AES-CBC to command-and-control servers and achieves persistence through scheduled tasks and UAC bypass techniques. No official patches or vendor advisories have been published for this malware. Detection can leverage known indicators such as malicious domains and file hashes.

The malware compromises user privacy and security by stealing browser data, saved passwords, and cryptocurrency wallet information, which can lead to financial theft and unauthorized access to accounts. Its multiple infection vectors and persistence mechanisms increase the likelihood of successful compromise. The use of AES-CBC encryption for data exfiltration complicates detection and response efforts. There are no known exploits in the wild beyond the described campaigns.

No official patch or vendor advisory is currently available for NWHStealer. Mitigation should focus on user awareness to avoid downloading software from untrusted or fake websites, especially those impersonating legitimate services like Proton VPN. Monitoring for suspicious scheduled tasks and DLL hijacking activity may help detect infections. Employ endpoint protection solutions capable of detecting known indicators such as the provided malicious domains and file hashes. Maintaining updated software and following security best practices can reduce exposure to this threat.