Loading story…
Threat actors are distributing fake games, mods, cracks, and software installers that abuse the legitimate Ren’Py visual novel engine to launch a multi-stage malware chain ending in Amatera Stealer. Researchers said the initial RenPy Loader (also called RenEngine Loader) extracts an encrypted ZIP archive, runs a BAT file through forfiles.exe, and then uses MSBuild to execute a trojanized .NET component, advancing the infection through several downloader and anti-analysis stages.
The later stages include anti-sandbox checks, removal of the Mark-of-the-Web via the Zone.Identifier alternate data stream, and reflective loading of a malicious Nancy .NET component before the stealer is decrypted and executed. The campaigns were hosted on fake download sites, itch.io pages, and file-sharing services, and used the EtherHiding technique to pull command-and-control details from blockchain data, complicating infrastructure takedowns and attribution; published indicators include malicious domains, IP addresses, and file hashes tied to the downloader, loader, and final payload.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Analysis revealed that the infection chain abused the legitimate Ren’Py engine, BAT scripts, and MSBuild to execute multi-stage payloads, then used EtherHiding to retrieve command-and-control information from blockchain data. The later stages decrypted and executed Amatera Stealer after anti-analysis and loader components were fetched.
Several malware campaigns were observed distributing fake games, mods, cracks, and software installers through fake download sites, itch.io pages, and file-sharing services. These lures deployed RenPy Loader (also called RenEngine Loader) as the initial infection vector.
The reporting published technical details and indicators of compromise for the campaigns, including malicious domains, IP addresses, and file hashes associated with the downloader, loader, and Amatera Stealer infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a large-scale malware distribution campaign using **pirated games** and **modified Ren’Py engine launchers** to deliver a Python-based loader dubbed **RenEngine** (detected by Kaspersky as `Trojan.Python.Agent.nb` / `HEUR:Trojan.Python.Agent.gen`). Victims are lured through “cracked” game downloads hosted on file-sharing services; when the game appears to stall at completion, embedded Python scripts execute, initiating the infection chain. Reporting attributes the campaign’s discovery to the **Howler Cell Threat Research Team**, with telemetry indicating broad global targeting and heavy victim concentration in **India, the U.S., and Brazil**. Analysis indicates RenEngine performs initial execution and hands off to a more advanced **HijackLoader** stage after environment checks (including sandbox/virtualization and hypervisor detection). HijackLoader is described as using **process doppelganging** before deploying the final payload, **ACR Stealer**, which steals browser credentials/cookies, system information, clipboard data, and cryptocurrency wallet details. Separate long-term tracking notes RenEngine activity dating back to at least **March 2025**, when it was used to distribute **Lumma Stealer**, with current activity shifting to **ACR Stealer** as the primary payload.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Researchers linked **PavinLoader**, a multi-stage `.NET` malware loader, to several intrusion chains that used **ClickFix lures, fake software downloads, and malicious RenPy packages** to infect victims. Across the campaigns, operators relied on trojanized and heavily obfuscated `.NET` DLLs, along with abuse of **MSBuild** through `.csproj` and `.bat` files, to execute later stages while complicating analysis and detection. The loader retrieved command-and-control details using **EtherHiding**, including Binance Smart Chain RPC calls to pull infrastructure data from blockchain-hosted content, and then fetched additional payloads. In observed cases, PavinLoader delivered **Amatera Stealer** and at times **HijackLoader**, while also using anti-analysis and anti-forensics measures such as AMSI/ETW-related evasion strings, virtualization checks, locale filtering, and infrastructure-provider checks; shared artifacts and builder-like scripts led researchers to assess that it may be operated as a **Loader-as-a-Service**, though no commercial panel or offering was confirmed.
Aug 25, 2026