Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Cracked game installers are again being used as a delivery channel for credential theft, but the latest wave adds an unusual twist: the malicious code hides behind a Ren’Py game launcher. The loader, now tracked as RenEngine, arrives bundled with game repacks and mods that look normal and even run as expected, while quietly preparing the next stage of the attack chain. The campaign has been active since at least April 2025 and remains ongoing, reaching an estimated 400,000 victims worldwide. Telemetry reviewed by the researchers suggests about 5,000 new hits per day, with the highest concentrations in India, the United States, and Brazil. This scale matters because the initial lure relies on social trust inside piracy communities rather than a software vulnerability, making it hard to stop with patching alone. Cyderes researchers noted the malware after spotting malicious logic embedded in what looked like a legitimate Ren’Py-based launcher. In the same cases, they also analyzed a fresh HijackLoader variant that brings added anti‑analysis modules, including checks for GPUs, hypervisor names, and VM-linked MAC addresses. Together, RenEngine and HijackLoader form a dual-loader setup that helps the operators swap payloads quickly as defenses change. A typical run starts when a user executes the pirated installer, then RenEngine decrypts and launches the second stage. Attack overview (Source – Cyderes) HijackLoader is then introduced through DLL side-loading and module stomping, and the final payload observed in this chain is ACR Stealer. ACR Stealer is built to collect browser passwords and cookies, crypto wallet data, and other system details, then send it to attacker infrastructure. Some chains have also delivered other stealers, such as Vidar. Infection mechanism inside Ren’Py Infection begins in the game folder, where Instaler.exe is a real Ren’Py launcher but is abused to run a compiled script from archive.rpa. The build strips plain .rpy files and keeps only .rpyc, reducing visibility during scans. Files and directories dropped by zip (Source – Cyderes) Next, RenEngine reads a local .key file, Base64-decodes it into JSON, and uses the password value to XOR-decrypt an embedded archive before running the next executable. RenEngine Loader configuration (Source – Cyderes) When sandbox checks are enabled, the loader scores the environment and exits silently if it believes it is running in a virtual machine. For defense, treat piracy installers and mods as high risk and block them where possible. Watch for Ren’Py launchers unpacking RPA content, Base64/XOR staging, and aggressive VM checks, then correlate with suspicious DLL side-loading and sudden credential theft traffic across endpoints today. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post RenEngine Loader Using Stealthy Multi‑Stage Execution Chain to Bypass Security Controls appeared first on Cyber Security News .

Security researchers uncover evidence that the Windows-based 'RenEngine loader' malware has infected around 30,000 users in the US alone.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

El equipo de Threat Research de Kaspersky ha publicado un análisis técnico sobre RenEngine, un loader de malware que se distribuye a través de juegos modificados y software pirateado. Detectado por primera vez en marzo de 2025, la amenaza ha afectado a usuarios en varias regiones, incluida América Latina, y amplía el riesgo más allá de la comunidad gaming hacia quienes buscan programas sin licencia…

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Un nuovo malware chiamato RenEngine Loader si diffonde tramite videogiochi piratati, installando trojan in grado di rubare dati sensibili da centinaia di migliaia di computer.

La amenaza, detectada por Kaspersky, utiliza instaladores aparentemente legítimos para descargar malware que roba información de los usuarios. El equipo de Threat Research de Kaspersky ha publicado un análisis técnico sobre RenEngine, un loader de malware que se distribuye a través de juegos modificados y software pirateado. Detectado por primera vez en marzo de 2025, la amenaza ha afectado a usuarios en varias regiones, incluida América Latina, y amplía el riesgo más allá de la comunidad gaming hacia quienes buscan programas sin licencia.

Attackers are hiding malware inside fake game and software installers. Malwarebytes Labs calls the threat RenPy Loader. Once it runs, the loader starts a multi-stage chain that ends in Amatera Stealer. Victims see a normal install screen while malicious code runs in the background. At a glance Malware family RenPy Loader (also RenEngine Loader), delivering Amatera Stealer Threat actor

Security researchers uncover evidence that the Windows-based 'RenEngine loader' malware has infected around 30,000 users in the US alone.

Security researchers uncover evidence that the Windows-based 'RenEngine loader' malware has infected around 30,000 users in the US alone.

Sicherheitsforscher haben die Kampagne am heutigen Montag öffentlich gemacht. Trojaner in Raubkopien versteckt Im Zentrum der Angriffswelle steht ein neu entdecktes Werkzeug namens RenEngine-Loader. Es wird in illegalen Kopien von Blockbustern wie Far Cry, FIFA und Assassin’s Creed versteckt. Wer die vermeintlich kostenlosen Spiele herunterlädt, installiert sich unbemerkt Schadsoftware auf den Rechner. Anzeige: Über 400.000 […] The post RenEngine-Loader: Trojaner in Raubkopien stiehlt 400.000 Passwörter appeared first on BornCity.

  A Windows-focused malware operation spreading through pirated PC games has potentially compromised more than 400,000 devices worldwide, according to research released by Cyderes. The company identified the threat as “RenEngine loader” and reported that roughly 30,000 affected users are located in the United States alone. Investigators found the malicious code embedded inside cracked and repackaged versions of popular game franchises, including Far Cry, Need for Speed, FIFA, and Assassin’s Creed. The infected installers appear to function normally, allowing users to download and play the games. However, while the visible game content runs as expected, concealed code executes in parallel without the user’s awareness. Researchers traced part of the operation to a legitimate launcher built on Ren'Py, an engine commonly used for visual novel-style games. The attackers embedded harmful components within this launcher framework. When executed, the launcher decompresses archived game files as intended, but at the same time initiates the hidden malware routine. According to Cyderes, the campaign has been active since at least April of last year and remains ongoing. In October, the operators modified the malware to include an embedded telemetry URL. Each time the RenEngine loader runs, it connects to this address, allowing the attackers to log activity. Analysis of that telemetry endpoint enabled researchers to estimate overall infection levels, with the system recording between 4,000 and 10,000 visits per day. Telemetry data indicates that the largest concentration of victims is located in India, the United States, and Brazil. The US accounts for approximately 30,000 of the infected systems identified through this tracking mechanism. The loader’s primary function is to deliver additional malicious software onto compromised machines. In multiple cases, researchers observed it deploying a Windows-based information stealer known as ARC. This malware is designed to extract stored browser passwords, session cookies, cryptocurrency wallet information, autofill entries, clipboard data, and system configuration details. Cyderes also reported observing alternative payloads delivered through the same loader infrastructure, including Rhadamanthys stealer, Async RAT, and XWorm. These programs are capable of credential theft and, in some cases, remote system control, enabling attackers to monitor activity or manipulate infected devices. The investigation identified one distribution source, dodi-repacks[.]site, as hosting downloads containing the embedded malware. The domain has previously been associated with other malicious distribution activity. Detection remains limited at the initial infection stage. Public scan results from Google’s VirusTotal platform indicate that, aside from Avast, AVG, and Cynet, most antivirus engines currently do not flag the loader component as malicious. This detection gap increases the likelihood that users may remain unaware of compromise. Users who suspect infection are advised to run updated security scans immediately. If concerns persist, Windows System Restore may help revert the device to a prior clean state. In cases where compromise cannot be confidently removed, a full operating system reinstallation may be necessary. The findings reinforce a recurring cybersecurity risk: unauthorized software downloads frequently serve as a delivery channel for concealed malware capable of exposing personal data and granting attackers extended access to victim systems.

A malware campaign using pirated PC games has infected over 400,000 devices with the

Dual-stage RenEngine malware spreads via pirated AAA games, infecting 400,000+ systems worldwide with stealthy loaders and info-stealing payloads.