A fake ProtonVPN website was used to deliver the AZORult information-stealing malware to potential victims. Kaspersky researchers discovered the fake website was registered via a Russian registrar in November 2019. The fake website is registered via an affiliation banner network malvertising as one of the initial infection vectors. The malware collects system information that gets delivered to a command-and-control server located on the same server as the fake site, at accounts[.]protonvpn[.]store. This information will then be packed and exfiltrated to the threat actors operating this malvertising campaign that abuses the service.
Source: https://www.bleepingcomputer.com/news/security/azorult-malware-infects-victims-via-fake-protonvpn-installer/