Loading story…
Security researchers reported a large-scale malware distribution campaign using pirated games and modified Ren’Py engine launchers to deliver a Python-based loader dubbed RenEngine (detected by Kaspersky as Trojan.Python.Agent.nb / HEUR:Trojan.Python.Agent.gen). Victims are lured through “cracked” game downloads hosted on file-sharing services; when the game appears to stall at completion, embedded Python scripts execute, initiating the infection chain. Reporting attributes the campaign’s discovery to the Howler Cell Threat Research Team, with telemetry indicating broad global targeting and heavy victim concentration in India, the U.S., and Brazil.
Analysis indicates RenEngine performs initial execution and hands off to a more advanced HijackLoader stage after environment checks (including sandbox/virtualization and hypervisor detection). HijackLoader is described as using process doppelganging before deploying the final payload, ACR Stealer, which steals browser credentials/cookies, system information, clipboard data, and cryptocurrency wallet details. Separate long-term tracking notes RenEngine activity dating back to at least March 2025, when it was used to distribute Lumma Stealer, with current activity shifting to ACR Stealer as the primary payload.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In February 2026, researchers from Kaspersky and Howler Cell publicly documented the campaign's mechanics, including fake loading screens, Python-based anti-analysis logic, process doppelganging, and data theft from browsers, clipboards, and cryptocurrency wallets. They also reported the campaign had affected more than 400,000 machines globally, with major impact across countries including India, the U.S., Brazil, Russia, Spain, Turkey, and Germany.
Researchers said more recent RenEngine intrusions changed final payloads from Lumma to ACR Stealer, with Vidar also observed in some cases. The infection chain used sandbox checks, DLL hijacking, and HijackLoader to inject the stealer into legitimate Windows processes.
By April 2025, an ongoing mass malware campaign was using modified Ren'Py-based game launchers bundled with pirated titles to infect victims worldwide. The operation spread through piracy and gaming sites plus redirect chains to infected archives.
Kaspersky reported first seeing the previously undocumented RenEngine loader in the wild in March 2025. Early activity used trojanized pirated games and software to deliver Lumma Stealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 47 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurelist.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are distributing fake games, mods, cracks, and software installers that abuse the legitimate **Ren’Py** visual novel engine to launch a multi-stage malware chain ending in **Amatera Stealer**. Researchers said the initial **RenPy Loader** (also called **RenEngine Loader**) extracts an encrypted ZIP archive, runs a BAT file through `forfiles.exe`, and then uses **MSBuild** to execute a trojanized .NET component, advancing the infection through several downloader and anti-analysis stages. The later stages include anti-sandbox checks, removal of the Mark-of-the-Web via the `Zone.Identifier` alternate data stream, and reflective loading of a malicious **Nancy** .NET component before the stealer is decrypted and executed. The campaigns were hosted on fake download sites, **itch.io** pages, and file-sharing services, and used the **EtherHiding** technique to pull command-and-control details from blockchain data, complicating infrastructure takedowns and attribution; published indicators include malicious domains, IP addresses, and file hashes tied to the downloader, loader, and final payload.
Jul 21, 2026
Multiple active malware campaigns are using **trojanized installers** and social engineering—rather than software vulnerabilities—to gain initial access and then deploy credential theft or remote-control capabilities. Intel 471 reported a new Android banking trojan dubbed **FvncBot** targeting Polish mobile banking users by impersonating an *mBank* “security” app; the dropper prompts installation of an additional “Play” component and then abuses **Android Accessibility Services** for persistence and control, enabling **keylogging**, **screen capture**, and hidden **VNC-style remote interaction** to facilitate fraudulent transactions. Separately, Cyderes described an ongoing, large-scale piracy-channel campaign where cracked game installers hide behind a legitimate-looking **Ren’Py** launcher tracked as **RenEngine**, which decrypts and launches subsequent stages and introduces **HijackLoader** via techniques including **DLL side-loading** and module stomping; observed final payloads include **ACR Stealer** (and in some cases **Vidar**) to exfiltrate browser credentials, cookies, and crypto wallet data. Cybereason detailed a different installer-themed operation in Chinese-speaking communities delivering **ValleyRat/Winos 4.0** attributed to **Silver Fox APT**, notable for using the rare **“PoolParty Variant 7”** process injection (abusing Windows I/O completion ports and `ZwSetIoCompletion()` after duplicating a handle from `Explorer.exe`) plus a strengthened watchdog mechanism via injection into `Explorer.exe` and `UserAccountBroker.exe` to maintain persistence.
Jun 29, 2026
Breakglass Intelligence reported that **ACRStealer** is running an active credential-theft operation through multiple delivery chains, including a compromised `.edu` WordPress site and a trojanized **Chris-PC RAM Booster** installer. The malware uses a four-stage infection flow that progresses from PowerShell or installer-based execution to Go and .NET loaders, then decrypts and injects shellcode in memory. Researchers said newer samples introduced a previously undocumented .NET loader, **CoreHubManager**, a new 16-byte XOR key, **AES-256-CBC** shellcode decryption, and **Heaven’s Gate** WoW64 transitions to run x64 code from a 32-bit process. Payloads were also signed with a stolen **ASUSTeK EV code-signing certificate**, allowing binaries such as `sunwukongs.exe` to better evade SmartScreen and other trust controls. Once installed, ACRStealer steals credentials, browser data, DPAPI-protected secrets, Windows Hello NGC keys, smart card certificates, Azure AD OAuth tokens, wallets, documents, and tokens from more than 200 applications, then exfiltrates the data over HTTPS. The malware also uses custom AFD socket operations and dead-drop resolvers hosted on **Steam**, **Google Docs/Slides**, and **Telegram** pages to retrieve command-and-control infrastructure. Breakglass mapped **17 C2 IPs** in the newer cluster and **9 live C2 servers** in the earlier campaign, with the larger set hosted by **VDSINA**, pointing to a concentrated infrastructure footprint. Researchers also found overlap with **SectopRAT**, **AmateraStealer**, **NetSupport RAT**, **OffLoader**, **HIjackLoader/IDATLoader**, and **ClickFix/FakeCAPTCHA** chains, and said ACRStealer has been rebranded as **AmateraStealer** and marketed as a malware-as-a-service offering.
Jun 29, 2026