Loading story…
Researchers reported that threat actors are distributing the Rust-based infostealer NWHStealer through a new infection chain built around the Bun JavaScript runtime, using fake game cheats, software cracks, and installers packaged in ZIP archives. The lures have been hosted on legitimate services including GitHub, GitLab, SourceForge, and Itch.io, helping the malware blend in with normal downloads and increasing the likelihood of user execution.
The Bun-based loader contains obfuscated JavaScript, performs anti-virtualization checks, gathers host and public IP data, captures screenshots, and communicates with encrypted command-and-control infrastructure before retrieving an encrypted next-stage payload. In some cases, a fallback loader named dw.exe is included to preserve delivery if the primary chain fails. The final payload observed was NWHStealer, which can steal browser credentials, cryptocurrency wallet data, Discord and Steam information, FTP client data, and other system details, while also establishing persistence, bypassing UAC, and obtaining updated C2 addresses through Telegram.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Malwarebytes published analysis describing the Bun-based loader, fallback loader behavior, host reconnaissance, screenshot capture, C2 communications, and final deployment of NWHStealer. The report also noted hosting on legitimate platforms such as GitHub, GitLab, SourceForge, and Itch.io and detailed the stealer's ability to exfiltrate browser, wallet, messaging, and FTP data.
Researchers reported that attackers began distributing the Rust-based infostealer NWHStealer through fake software downloads, game cheats, cracks, and installers in ZIP archives. The new infection chain uses the Bun JavaScript runtime to package and execute an obfuscated loader with anti-VM checks, encrypted C2 communications, and in-memory deployment of the next-stage payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Threat actors are distributing fake games, mods, cracks, and software installers that abuse the legitimate **Ren’Py** visual novel engine to launch a multi-stage malware chain ending in **Amatera Stealer**. Researchers said the initial **RenPy Loader** (also called **RenEngine Loader**) extracts an encrypted ZIP archive, runs a BAT file through `forfiles.exe`, and then uses **MSBuild** to execute a trojanized .NET component, advancing the infection through several downloader and anti-analysis stages. The later stages include anti-sandbox checks, removal of the Mark-of-the-Web via the `Zone.Identifier` alternate data stream, and reflective loading of a malicious **Nancy** .NET component before the stealer is decrypted and executed. The campaigns were hosted on fake download sites, **itch.io** pages, and file-sharing services, and used the **EtherHiding** technique to pull command-and-control details from blockchain data, complicating infrastructure takedowns and attribution; published indicators include malicious domains, IP addresses, and file hashes tied to the downloader, loader, and final payload.
Jul 21, 2026
Threat researchers uncovered multiple malware campaigns abusing trusted developer and AI distribution platforms to spread **Rust-based infostealers** through fake or typosquatted repositories. HiddenLayer found that a malicious Hugging Face project, `Open-OSS/privacy-filter`, impersonated OpenAI’s legitimate Privacy Filter repository, briefly became the platform’s top trending project, and was downloaded about **244,000** times before removal. The repository’s `loader.py` fetched a multi-stage payload ending in the `sefirah` infostealer, which harvested browser data, Discord tokens, cryptocurrency wallet data, SSH/FTP/VPN credentials, local files, system details, and screenshots, then exfiltrated the data to `recargapopular[.]com`. Researchers also linked the activity to overlaps with an npm typosquatting campaign associated with the **WinOS 4.0** implant. In a parallel campaign, Netskope reported that attackers impersonated the OpenClaw project with a fake installer site and a typosquatted GitHub organization to deliver a previously undocumented Rust dropper called **Hologram** and a modular implant framework. The malware targeted credentials from more than **250** cryptocurrency wallet, password manager, and 2FA browser extensions, while using anti-sandbox checks, in-memory .NET execution, reflective PE loading, persistence via `Userinit`, COM hijacking, and scheduled tasks, plus direct NT syscall thread injection. Operators staged and relayed infrastructure through legitimate services including **Azure DevOps, Telegram, Hookdeck, snippet.host, and Pastebin**; Netskope said the operation marked the first documented malware abuse of Hookdeck as a C2 relay and later evolved into a third wave, **Pathfinder**, that added confirmed Vidar infostealer delivery.
Jun 29, 2026