NWHStealer Adopts Bun JavaScript Runtime for Distribution — Rust Infostealer via Bun-Bundled JS Loaders — Threadlinqs Intelligence
As of 2026-05-30, NWHStealer Adopts Bun JavaScript Runtime for Distribution — Rust Infostealer via Bun-Bundled JS Loaders is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 44 indicators of compromise.
Threat ID: TL-2026-0470 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Malwarebytes Labs (May 6 2026) reports that the NWHStealer Rust-based Windows infostealer has adopted the Bun JavaScript runtime as a novel distribution mechanism. Bun-packaged Installer.exe samples
Malwarebytes Labs threat-intel hunting (published 2026-05-06 by Gabriele Orini) surfaced a new distribution wave of NWHStealer — a Rust-based Windows infostealer family already tracked as TL-2026-0405 — that abuses the Bun JavaScript runtime (https://bun.sh) to bundle and execute its loader chain. The technique is novel: rather than ship a native PE loader, the operators ship a single Bun-compiled standalone Windows binary (Installer.exe, ~80 MB) that internally embeds a small self-contained Bun runtime plus two JavaScript files (sysreq.js and memload.js). When Installer.exe runs, the Bun runtime executes the embedded JS in-process. Because Bun bundles V8/JavaScriptCore and a full Win32 FFI surface (bun:ffi), the JS loaders can call native Windows APIs directly without producing the usual native code-signing or import-table indicators that EDRs typically alert on.
The loader chain is two-stage. Stage one (sysreq.js) implements a weighted anti-analysis check: it enumerates running processes, MAC vendors, OEM keys, hostname patterns, parent process, screen dimensions, mouse movement, RAM size, CPU vendor and process count, then sums weighted scores for known sandbox/VM indicators (VirtualBox, VMware, QEMU, Hyper-V, Sandboxie, Cuckoo, Joe Sandbox, ANY.RUN, Triage, CAPE, AnyRun, etc.). If the score exceeds an internal threshold, execution silently exits. Otherwise, sysreq.js hands off to stage two (memload.js).
Stage two (memload.js) performs network fetches over HTTPS to attacker-controlled endpoints — primarily /api/status (system telemetry POST), /api/update (encrypted next-stage payload GET) and /api/report (exfiltration POST) — across a rotating pool of C2 hosts (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club). Telegram channels are used to publish updated C2 lists for dynamic rotation. Returned payloads are AES-256-CBC encrypted with a key embedded in the loader; memload.js decrypts them and uses the bun:ffi binding to invoke a chain of native APIs — VirtualAlloc / VirtualProtect to allocate RWX memory, LoadLibraryA / GetProcAddress to resolve imports, RtlAddFunctionTable to register exception unwind data, SearchPathA for module discovery, and CreateThread to start the decrypted shellcode. This is reflective in-memory loading executed entirely from the Bun-bundled JS context, so the NWHStealer Rust payload never touches disk as a PE.
Post-exploitation behaviour aligns with prior NWHStealer activity: the Rust stealer harvests credentials, cookies and saved sessions from Chromium and Gecko browsers, cryptocurrency wallet files (MetaMask, Exodus, Atomic, Electrum and others), FTP client profiles (FileZilla, WinSCP), and chat clients (Discord token theft, Steam config and Telegram tdata). It establishes persistence via a Scheduled Task (often masquerading as a Windows Update or Realtek service) and elevates via the standard fodhelper / computerdefaults UAC-bypass autoElevate path. A secondary dw.exe payload (Bun-bundled XMRig drop) is deployed for resource-hijacking monetisation. Exfiltration is performed over the same HTTPS C2 channel as the loader fetches.
Lure delivery uses social-engineering bait packaged as game trainers and software activators (MOUSE_PI_Trainer_v1.0.zip, FiveM Mod.zip, VampireCrawlers_Trainer_v1.0.zip, MagicalPrincess_Trainer_v1.0.zip, TerraTechLegion_Trainer_v1.0.zip, TradingView-Activation-Script-0.9.zip, AutoTune 2026.zip, Metatune by Slate Digital 2026.zip, GoGoTv_Plus.zip, Autodesk.zip) hosted on legitimate platforms — GitHub, GitLab, MediaFire, Itch.io, SourceForge — to lower user suspicion and bypass URL-reputation filters. Build ID 0ddbfec60307 is observed across multiple samples, suggesting a single build-server. External IP enrichment occurs against api.ipify.org.
Defensive posture should focus on (a) detecting Bun-bundled standalone executables in user-writable directories and email/download paths (Bun standalone binaries are large — typically 50
Target sectors: consumer, gaming, cryptocurrency, creative-media, general
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 44 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1204.002, T1059.007, T1106, T1053.005, T1548.002, T1027.013, T1140, T1497, T1620