From fake Proton VPN sites to gaming mods, this Windows infostealer is everywhere