# NWHStealer Adopts Bun JavaScript Runtime for Distribution — Rust Infostealer via Bun-Bundled JS Loaders

> Malwarebytes Labs (May 6 2026) reports that the NWHStealer Rust-based Windows infostealer has adopted the Bun JavaScript runtime as a novel distribution mechanism. Bun-packaged Installer.exe samples embed two JavaScript loaders — sysreq.js (weighted anti-VM/sandbox scoring) and memload.js (C2 fetch, AES-256-CBC decryption, and bun:ffi-based reflective loading) — that pull encrypted next-stage payloads from new C2 infrastructure (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club) and inject NWHStealer plus an XMRig miner into legitimate processes. Lures are distributed as game trainers and software activators on GitHub, GitLab, MediaFire, Itch.io and SourceForge.

- **Published:** 2026-05-06T12:00:00Z
- **Last reviewed:** 2026-05-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0470
- **ID:** TL-2026-0470
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes Labs threat-intel hunting (published 2026-05-06 by Gabriele Orini) surfaced a new distribution wave of NWHStealer — a Rust-based Windows infostealer family already tracked as TL-2026-0405 — that abuses the Bun JavaScript runtime (https://bun.sh) to bundle and execute its loader chain. The technique is novel: rather than ship a native PE loader, the operators ship a single Bun-compiled standalone Windows binary (Installer.exe, ~80 MB) that internally embeds a small self-contained Bun runtime plus two JavaScript files (sysreq.js and memload.js). When Installer.exe runs, the Bun runtime executes the embedded JS in-process. Because Bun bundles V8/JavaScriptCore and a full Win32 FFI surface (bun:ffi), the JS loaders can call native Windows APIs directly without producing the usual native code-signing or import-table indicators that EDRs typically alert on.

The loader chain is two-stage. Stage one (sysreq.js) implements a weighted anti-analysis check: it enumerates running processes, MAC vendors, OEM keys, hostname patterns, parent process, screen dimensions, mouse movement, RAM size, CPU vendor and process count, then sums weighted scores for known sandbox/VM indicators (VirtualBox, VMware, QEMU, Hyper-V, Sandboxie, Cuckoo, Joe Sandbox, ANY.RUN, Triage, CAPE, AnyRun, etc.). If the score exceeds an internal threshold, execution silently exits. Otherwise, sysreq.js hands off to stage two (memload.js).

Stage two (memload.js) performs network fetches over HTTPS to attacker-controlled endpoints — primarily /api/status (system telemetry POST), /api/update (encrypted next-stage payload GET) and /api/report (exfiltration POST) — across a rotating pool of C2 hosts (whale-ether.pro, cosmic-nebula.cc, silent-harvester.cc, silent-orbit.cc, support-onion.club). Telegram channels are used to publish updated C2 lists for dynamic rotation. Returned payloads are AES-256-CBC encrypted with a key embedded in the loader; memload.js decrypts them and uses the bun:ffi binding to invoke a chain of native APIs — VirtualAlloc / VirtualProtect to allocate RWX memory, LoadLibraryA / GetProcAddress to resolve imports, RtlAddFunctionTable to register exception unwind data, SearchPathA for module discovery, and CreateThread to start the decrypted shellcode. This is reflective in-memory loading executed entirely from the Bun-bundled JS context, so the NWHStealer Rust payload never touches disk as a PE.

Post-exploitation behaviour aligns with prior NWHStealer activity: the Rust stealer harvests credentials, cookies and saved sessions from Chromium and Gecko browsers, cryptocurrency wallet files (MetaMask, Exodus, Atomic, Electrum and others), FTP client profiles (FileZilla, WinSCP), and chat clients (Discord token theft, Steam config and Telegram tdata). It establishes persistence via a Scheduled Task (often masquerading as a Windows Update or Realtek service) and elevates via the standard fodhelper / computerdefaults UAC-bypass autoElevate path. A secondary dw.exe payload (Bun-bundled XMRig drop) is deployed for resource-hijacking monetisation. Exfiltration is performed over the same HTTPS C2 channel as the loader fetches.

Lure delivery uses social-engineering bait packaged as game trainers and software activators (MOUSE_PI_Trainer_v1.0.zip, FiveM Mod.zip, VampireCrawlers_Trainer_v1.0.zip, MagicalPrincess_Trainer_v1.0.zip, TerraTechLegion_Trainer_v1.0.zip, TradingView-Activation-Script-0.9.zip, AutoTune 2026.zip, Metatune by Slate Digital 2026.zip, GoGoTv_Plus.zip, Autodesk.zip) hosted on legitimate platforms — GitHub, GitLab, MediaFire, Itch.io, SourceForge — to lower user suspicion and bypass URL-reputation filters. Build ID 0ddbfec60307 is observed across multiple samples, suggesting a single build-server. External IP enrichment occurs against api.ipify.org.

Defensive posture should focus on (a) detecting Bun-bundled standalone executables in user-writable directories and email/download paths (Bun standalone binaries are large — typically 50-90 MB — and contain the recognisable embedded Bun runtime header), (b) flagging unsigned ~80 MB executables that perform HTTPS POSTs to /api/status, /api/update or /api/report shortly after launch, (c) hunting on the published SHA256 hash set and the five C2 domains across proxy / DNS / EDR telemetry, (d) monitoring scheduled-task creation by recently-downloaded executables, and (e) blocking the C2 domains and any newly-registered .pro / .cc / .club domains matching the naming pattern (cosmic-*, silent-*, *-orbit, *-onion, etc.). MITRE coverage spans Initial Access (T1189 / T1204.002), Execution (T1059.007), Defense Evasion (T1027.013, T1140, T1497, T1620, T1548.002, T1036), Persistence (T1053.005), Credential Access (T1555, T1539, T1552), Discovery (T1082, T1057, T1518), Collection (T1005, T1217), Command and Control (T1071.001, T1573.001, T1102, T1568) and Impact (T1496).

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1106 Native API
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1055 Process Injection
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1217 Browser Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1102.001 Dead Drop Resolver
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [Attackers adopt JavaScript runtime Bun to spread NWHStealer](https://www.malwarebytes.com/blog/threat-intel/2026/05/attackers-adopt-javascript-runtime-bun-to-spread-nwhstealer)
- [Bun — Standalone executable bundling (bun build --compile)](https://bun.sh/docs/bundler/executables)
- [Bun FFI documentation (bun:ffi)](https://bun.sh/docs/api/ffi)
- [MITRE ATT&CK T1027.013 Obfuscated Files or Information: Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013/)
- [MITRE ATT&CK T1497 Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)
- [MITRE ATT&CK T1620 Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002/)
- [MITRE ATT&CK T1053.005 Scheduled Task/Job: Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK T1102 Web Service (Telegram dead-drop resolver)](https://attack.mitre.org/techniques/T1102/)
- [MITRE ATT&CK T1555 Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/)
- [Threadlinqs Intelligence — TL-2026-0405 (prior NWHStealer Antigravity campaign)](https://intel.threadlinqs.com/threat/TL-2026-0405)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0470