NWHStealer Delivery Chain Adds Anti-VM Checks and Encrypted C2 Traffic

The threat landscape is witnessing a shift in the distribution of NWHStealer. This pervasive Rust-based information-stealing malware aggressively extracts sensitive data from compromised Windows systems.

Historically, threat actors distributed this malware through deceptive lures such as fake Proton VPN installers, hardware utilities, and trojanized gaming modifications.

Once deployed, the malware targets browser data, saved credentials, and cryptocurrency wallet information, leading to rapid account takeovers and severe financial losses.

In recent campaigns, attackers have adopted a novel evasion technique by packaging their malicious code within the Bun JavaScript runtime.

Bun is a legitimate, high-performance toolkit designed as a modern alternative to Node.js. Because Bun is relatively new and less commonly associated with malware campaigns, it provides threat actors with an attractive vehicle for hiding malicious payloads within larger, seemingly benign executables.

In this latest delivery chain, users are tricked into downloading malicious archives containing an installer executable. This file embeds heavily obfuscated JavaScript code bundled directly with the Bun runtime.

To ensure the highest infection success rate, attackers also include an alternative self-injection loader as a backup mechanism in case the primary Bun loader fails to connect to its remote infrastructure.

NWHStealer Adds Stealthy Delivery

The malicious JavaScript executed by the Bun runtime is hidden within a specific section of the executable and split into distinct functional scripts.

The primary evasion component is a dedicated script that identifies virtualized environments and automates security analysis.

This script uses a sophisticated scoring system based on various hardware and software checks to determine whether the host system is a legitimate consumer target or a security researcher’s sandbox.

It executes multiple PowerShell Common Information Model and Windows Management Instrumentation commands to thoroughly evaluate the environment.

According to Malware Bytes research, the secondary component of the JavaScript loader establishes encrypted communication with the attacker’s server and deploys the final payload.

Before downloading the actual stealer, the malware gathers preliminary system profiling data, the results of the anti-virtualization checks, the victim’s public IP address, and a base64-encoded screenshot of the desktop.

This intelligence is transmitted to the command-and-control server at domains such as silent-harvester.cc and silent-orbit.cc. Following this initial report, the loader requests a unique seed value used to derive an AES encryption key.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.