NWHStealer Adopts Bun JavaScript Runtime for Distribution — Rust Infostealer via Bun-Bundled JS Loaders
NWHStealer Adopts Bun JavaScript Runtime for Distribution (TL-2026-0470), also tracked as NWHStealer Bun campaign, is a high-severity malware campaign, first published 2026-05-06. It has no confirmed attribution, affects Microsoft Windows (all supported client and server versions), maps to 26 MITRE ATT&CK techniques (T1005, T1027.013, T1036.005), and is covered by 9 detection rules and 44 indicators of compromise.
Key facts for TL-2026-0470
- Threat ID
- TL-2026-0470
- Also known as
- NWHStealer Bun campaign, NWH Bun-runtime loader, Bun-bundled NWHStealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-06
- Last reviewed
- 2026-05-06
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, cryptocurrency, creative-media, general
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 44
Malware and tooling in NWHStealer Adopts Bun JavaScript Runtime for Distribution
Malware and tooling: NWHStealer, xmrig, Bun runtime (bun build --compile), Custom HTTP(S) C2 with /api/status, /api/update, /api/report endpoints
Malwarebytes Labs (May 6 2026) reports that the NWHStealer Rust-based Windows infostealer has adopted the Bun JavaScript runtime as a novel distribution mechanism. Bun-packaged Installer.exe samples embed two JavaScript loaders — sysreq.js (weighted anti-VM/sandbox scoring) and memload.js (C2 fetch, AES-256-CBC decryption, and bun:ffi-based reflective loading) — that pull encrypted next-stage payloads from new C2 infrastructure (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club) and inject NWHStealer plus an XMRig miner into legitimate processes. Lures are distributed as game trainers and software activators on GitHub, GitLab, MediaFire, Itch.io and SourceForge.
How NWHStealer Adopts Bun JavaScript Runtime for Distribution works
Malwarebytes Labs threat-intel hunting (published 2026-05-06 by Gabriele Orini) surfaced a new distribution wave of NWHStealer — a Rust-based Windows infostealer family already tracked as TL-2026-0405 — that abuses the Bun JavaScript runtime (https://bun.sh) to bundle and execute its loader chain. The technique is novel: rather than ship a native PE loader, the operators ship a single Bun-compiled standalone Windows binary (Installer.exe, ~80 MB) that internally embeds a small self-contained Bun runtime plus two JavaScript files (sysreq.js and memload.js). When Installer.exe runs, the Bun runtime executes the embedded JS in-process. Because Bun bundles V8/JavaScriptCore and a full Win32 FFI surface (bun:ffi), the JS loaders can call native Windows APIs directly without producing the usual native code-signing or import-table indicators that EDRs typically alert on.
The loader chain is two-stage. Stage one (sysreq.js) implements a weighted anti-analysis check: it enumerates running processes, MAC vendors, OEM keys, hostname patterns, parent process, screen dimensions, mouse movement, RAM size, CPU vendor and process count, then sums weighted scores for known sandbox/VM indicators (VirtualBox, VMware, QEMU, Hyper-V, Sandboxie, Cuckoo, Joe Sandbox, ANY.RUN, Triage, CAPE, AnyRun, etc.). If the score exceeds an internal threshold, execution silently exits. Otherwise, sysreq.js hands off to stage two (memload.js).
Stage two (memload.js) performs network fetches over HTTPS to attacker-controlled endpoints — primarily /api/status (system telemetry POST), /api/update (encrypted next-stage payload GET) and /api/report (exfiltration POST) — across a rotating pool of C2 hosts (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club). Telegram channels are used to publish updated C2 lists for dynamic rotation. Returned payloads are AES-256-CBC encrypted with a key embedded in the loader; memload.js decrypts them and uses the bun:ffi binding to invoke a chain of native APIs — VirtualAlloc / VirtualProtect to allocate RWX memory, LoadLibraryA / GetProcAddress to resolve imports, RtlAddFunctionTable to register exception unwind data, SearchPathA for module discovery, and CreateThread to start the decrypted shellcode. This is reflective in-memory loading executed entirely from the Bun-bundled JS context, so the NWHStealer Rust payload never touches disk as a PE.
Post-exploitation behaviour aligns with prior NWHStealer activity: the Rust stealer harvests credentials, cookies and saved sessions from Chromium and Gecko browsers, cryptocurrency wallet files (MetaMask, Exodus, Atomic, Electrum and others), FTP client profiles (FileZilla, WinSCP), and chat clients (Discord token theft, Steam config and Telegram tdata). It establishes persistence via a Scheduled Task (often masquerading as a Windows Update or Realtek service) and elevates via the standard fodhelper / computerdefaults UAC-bypass autoElevate path. A secondary dw.exe payload (Bun-bundled XMRig drop) is deployed for resource-hijacking monetisation. Exfiltration is performed over the same HTTPS C2 channel as the loader fetches.
Lure delivery uses social-engineering bait packaged as game trainers and software activators (MOUSE_PI_Trainer_v1.0.zip, FiveM Mod.zip, VampireCrawlers_Trainer_v1.0.zip, MagicalPrincess_Trainer_v1.0.zip, TerraTechLegion_Trainer_v1.0.zip, TradingView-Activation-Script-0.9.zip, AutoTune 2026.zip, Metatune by Slate Digital 2026.zip, GoGoTv_Plus.zip, Autodesk.zip) hosted on legitimate platforms — GitHub, GitLab, MediaFire, Itch.io, SourceForge — to lower user suspicion and bypass URL-reputation filters. Build ID 0ddbfec60307 is observed across multiple samples, suggesting a single build-server. External IP enrichment occurs against api.ipify.org.
Defensive posture should focus on (a) detecting Bun-bundled standalone executables in user-writable directories and email/download paths (Bun standalone binaries are large — typically 50-90 MB — and contain the recognisable embedded Bun runtime header), (b) flagging unsigned ~80 MB executables that perform HTTPS POSTs to /api/status, /api/update or /api/report shortly after launch, (c) hunting on the published SHA256 hash set and the five C2 domains across proxy / DNS / EDR telemetry, (d) monitoring scheduled-task creation by recently-downloaded executables, and (e) blocking the C2 domains and any newly-registered .pro / .cc / .club domains matching the naming pattern (cosmic-*, silent-*, *-orbit, *-onion, etc.). MITRE coverage spans Initial Access (T1189 / T1204.002), Execution (T1059.007), Defense Evasion (T1027.013, T1140, T1497, T1620, T1548.002, T1036), Persistence (T1053.005), Credential Access (T1555, T1539, T1552), Discovery (T1082, T1057, T1518), Collection (T1005, T1217), Command and Control (T1071.001, T1573.001, T1102, T1568) and Impact (T1496).
MITRE ATT&CK techniques used in TL-2026-0470
Collection
Defense Evasion
T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1106 Native API; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Dead Drop Resolver; T1568.002 Dynamic Resolution: Domain Generation Algorithms; T1573.001 Encrypted Channel: Symmetric Cryptography
Initial Access
discovery
T1217 Browser Information Discovery
Impact
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Privilege Escalation
T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Affected products and versions in NWHStealer Adopts Bun JavaScript Runtime for Distribution
- Microsoft — Windows (all supported client and server versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Chromium / Mozilla — Browsers (credential and cookie theft target)
Vulnerable versions: Chrome; Edge; Brave; Opera; Firefox - Multiple — Cryptocurrency wallet applications
Vulnerable versions: MetaMask; Exodus; Atomic Wallet; Electrum; Coinbase Wallet - Multiple — FTP and chat clients
Vulnerable versions: FileZilla; WinSCP; Discord; Telegram Desktop; Steam
Remediation for NWHStealer Adopts Bun JavaScript Runtime for Distribution
Immediate actions
- Block the five published C2 domains (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club) at DNS, proxy and firewall layers.
- Add the 13 published SHA256 hashes to EDR / AV blocklists and hunt across endpoint telemetry for prior execution.
- Hunt proxy / EDR telemetry for HTTPS POSTs to /api/status, /api/update, /api/report from user-launched executables in Downloads / Desktop / Temp / AppData paths.
- Audit recently-created Scheduled Tasks (last 30 days) referencing user-writable executable paths and review for masquerading service names (Realtek, Windows Update, NVIDIA, Adobe).
- Block downloads of trainer / activator ZIPs from MediaFire, Itch.io and SourceForge at the egress proxy where business risk allows; alert on GitHub / GitLab releases attaching unsigned > 50 MB executables.
Workarounds
- Where business need permits, block executable downloads from MediaFire and Itch.io at the egress proxy.
- Restrict Bun.exe and standalone Bun-bundled executables via AppLocker publisher / hash rules until business need is established.
- Disable PowerShell / cscript / JavaScript execution from user-writable directories via SRP / WDAC.
Longer-term hardening
- Deploy EDR with behavioural detection for reflective loading patterns (VirtualAlloc + VirtualProtect to RWX + CreateThread sequences originating from script hosts or Bun-bundled binaries).
- Author detections that flag standalone Bun-runtime binaries (size 50-90 MB, embedded Bun runtime signature, no Authenticode signature) executing from non-standard paths.
- Implement application allowlisting (WDAC / AppLocker) for Downloads / Desktop / Temp / AppData to block unsigned executables.
- Restrict UAC autoElevate paths and monitor fodhelper.exe / computerdefaults.exe registry hijack keys (HKCU\Software\Classes\ms-settings\Shell\Open\command, HKCU\Software\Classes\Folder\shell\open\command).
- Train users on the risk of game trainers, cracks and software activators sourced outside of vendor channels.
Timeline of NWHStealer Adopts Bun JavaScript Runtime for Distribution
- Threadlinqs catalogues prior NWHStealer Antigravity-themed campaign as TL-2026-0405 — same Rust stealer family, different distribution chain, zero IOC overlap with the Bun-runtime wave.
- C2 infrastructure (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club) registered and brought online ahead of the Bun-runtime distribution wave.
- Earliest Bun-bundled NWHStealer Installer.exe samples (build ID 0ddbfec60307) appear on lure-hosting platforms (GitHub, GitLab, MediaFire, Itch.io, SourceForge) packaged as game trainers and software activators.
- Malwarebytes hunting telemetry registers a spike in Bun-bundled standalone executables performing /api/status and /api/update HTTPS calls to the new C2 set.
- Reverse engineering of memload.js and sysreq.js confirms AES-256-CBC payload decryption and bun:ffi-based reflective loading via VirtualAlloc/VirtualProtect/CreateThread chains.
- Threadlinqs Intelligence ingests the Malwarebytes report as TL-2026-0470 for blue-team detection authoring and IOC correlation against existing C2 telemetry.
- Malwarebytes Labs publishes the Bun-runtime NWHStealer distribution research (author Gabriele Orini) with 13 SHA256 hashes, 5 C2 domains, lure ZIP names and full loader analysis.
- As of 2026-05-29, this NWHStealer Bun-runtime campaign remains active: Malwarebytes, SOC Prime, gbhackers and others (reporting May 6-8 2026) confirm ongoing distribution, and the broader NWHStealer family is still spreading via gaming/VPN/trading lures. No takedown, arrests, or sinkhole reported; resilient Telegram dead-drop + dw.exe backup and domain rotation keep the no-CVE technique live.
Sources cited for NWHStealer Adopts Bun JavaScript Runtime for Distribution
- Attackers adopt JavaScript runtime Bun to spread NWHStealer
- Bun — Standalone executable bundling (bun build --compile)
- Bun FFI documentation (bun:ffi)
- MITRE ATT&CK T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- MITRE ATT&CK T1497 Virtualization/Sandbox Evasion
- MITRE ATT&CK T1620 Reflective Code Loading
- MITRE ATT&CK T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- MITRE ATT&CK T1053.005 Scheduled Task/Job: Scheduled Task
- MITRE ATT&CK T1102 Web Service (Telegram dead-drop resolver)
- MITRE ATT&CK T1555 Credentials from Password Stores
- Threadlinqs Intelligence — TL-2026-0405 (prior NWHStealer Antigravity campaign)
Threats related to NWHStealer Adopts Bun JavaScript Runtime for Distribution
- OXLOADER Malware Loader Delivering CASTLESTEALER .NET Infostealer via Node.js Malvertising
- Operation Endgame: Global Law Enforcement Takedown Disrupts SocGholish, Amadey, and StealC Malware-as-a-Service Networks
- Millenium RAT v4: C++ Rewrite Fuels Y2K Operators' MaaS Campaign (62,289 Devices, 160+ Countries)
- Operation Muck and Load: Malicious Go Module (dnsub-scanning-tool) Fronts 222-Repo GitHub Malware Lure Network Delivering AsyncRAT/Quasar and Vidar
Detection coverage for TL-2026-0470
As of 2026-05-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0470 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.