Attackers are hiding malware inside fake game and software installers. Malwarebytes Labs calls the threat RenPy Loader. Once it runs, the loader starts a multi-stage chain that ends in Amatera Stealer. Victims see a normal install screen while malicious code runs in the background. At a glance Malware family RenPy Loader (also RenEngine Loader), delivering Amatera Stealer Threat actor

Security researchers uncover evidence that the Windows-based 'RenEngine loader' malware has infected around 30,000 users in the US alone.

A malware campaign using pirated PC games has infected over 400,000 devices with the

Sicherheitsforscher haben die Kampagne am heutigen Montag öffentlich gemacht. Trojaner in Raubkopien versteckt Im Zentrum der Angriffswelle steht ein neu entdecktes Werkzeug namens RenEngine-Loader. Es wird in illegalen Kopien von Blockbustern wie Far Cry, FIFA und Assassin’s Creed versteckt. Wer die vermeintlich kostenlosen Spiele herunterlädt, installiert sich unbemerkt Schadsoftware auf den Rechner. Anzeige: Über 400.000 […] The post RenEngine-Loader: Trojaner in Raubkopien stiehlt 400.000 Passwörter appeared first on BornCity.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Read more

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

La amenaza, detectada por Kaspersky, utiliza instaladores aparentemente legítimos para descargar malware que roba información de los usuarios. El equipo de Threat Research de Kaspersky ha publicado un análisis técnico sobre RenEngine, un loader de malware que se distribuye a través de juegos modificados y software pirateado. Detectado por primera vez en marzo de 2025, la amenaza ha afectado a usuarios en varias regiones, incluida América Latina, y amplía el riesgo más allá de la comunidad gaming hacia quienes buscan programas sin licencia.

El equipo de Threat Research de Kaspersky ha publicado un análisis técnico sobre RenEngine, un loader de malware que se distribuye a través de juegos modificados y software pirateado. Detectado por primera vez en marzo de 2025, la amenaza ha afectado a usuarios en varias regiones, incluida América Latina, y amplía el riesgo más allá de la comunidad gaming hacia quienes buscan programas sin licencia…

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

La amenaza, detectada por Kaspersky, utiliza instaladores aparentemente legítimos para descargar malware que roba información de los usuarios. 16 de marzo de 2026. El equipo de Threat Research de Kaspersky ha publicado un análisis técnico sobre RenEngine, un loader de malware que se distribuye a través de juegos modificados y software pirateado. Detectado por primera vez en marzo de 2025, la amenaza ha afectado a usuarios en varias regiones, incluida América Latina, y amplía el riesgo más allá de la comunidad gaming hacia quienes buscan programas sin licencia.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

Guía para eliminar scripts maliciosos en juegos piratas. Detectan malware RenEngine al 100% de la instalación en repacks este marzo de 2026.

كشف مركز كاسبرسكي الروسي لأبحاث التهديدات عن رصد برمجية خبيثة جديدة تُعرف باسم RenEngine، والتي أثارت اهتماماً واسعاً خلال الفترة الأخيرة

Kaspersky Threat Research details RenEngine, a loader spread via pirated software. The campaign expands the attack surface beyond games to unlicensed tools.

Kaspersky, RenEngine adlı kötü amaçlı yazılımın korsan oyun ve yazılım siteleri üzerinden yayıldığını açıkladı. Türkiye dahil birçok ülkede vakalar tespit edildi.

  A Windows-focused malware operation spreading through pirated PC games has potentially compromised more than 400,000 devices worldwide, according to research released by Cyderes. The company identified the threat as “RenEngine loader” and reported that roughly 30,000 affected users are located in the United States alone. Investigators found the malicious code embedded inside cracked and repackaged versions of popular game franchises, including Far Cry, Need for Speed, FIFA, and Assassin’s Creed. The infected installers appear to function normally, allowing users to download and play the games. However, while the visible game content runs as expected, concealed code executes in parallel without the user’s awareness. Researchers traced part of the operation to a legitimate launcher built on Ren'Py, an engine commonly used for visual novel-style games. The attackers embedded harmful components within this launcher framework. When executed, the launcher decompresses archived game files as intended, but at the same time initiates the hidden malware routine. According to Cyderes, the campaign has been active since at least April of last year and remains ongoing. In October, the operators modified the malware to include an embedded telemetry URL. Each time the RenEngine loader runs, it connects to this address, allowing the attackers to log activity. Analysis of that telemetry endpoint enabled researchers to estimate overall infection levels, with the system recording between 4,000 and 10,000 visits per day. Telemetry data indicates that the largest concentration of victims is located in India, the United States, and Brazil. The US accounts for approximately 30,000 of the infected systems identified through this tracking mechanism. The loader’s primary function is to deliver additional malicious software onto compromised machines. In multiple cases, researchers observed it deploying a Windows-based information stealer known as ARC. This malware is designed to extract stored browser passwords, session cookies, cryptocurrency wallet information, autofill entries, clipboard data, and system configuration details. Cyderes also reported observing alternative payloads delivered through the same loader infrastructure, including Rhadamanthys stealer, Async RAT, and XWorm. These programs are capable of credential theft and, in some cases, remote system control, enabling attackers to monitor activity or manipulate infected devices. The investigation identified one distribution source, dodi-repacks[.]site, as hosting downloads containing the embedded malware. The domain has previously been associated with other malicious distribution activity. Detection remains limited at the initial infection stage. Public scan results from Google’s VirusTotal platform indicate that, aside from Avast, AVG, and Cynet, most antivirus engines currently do not flag the loader component as malicious. This detection gap increases the likelihood that users may remain unaware of compromise. Users who suspect infection are advised to run updated security scans immediately. If concerns persist, Windows System Restore may help revert the device to a prior clean state. In cases where compromise cannot be confidently removed, a full operating system reinstallation may be necessary. The findings reinforce a recurring cybersecurity risk: unauthorized software downloads frequently serve as a delivery channel for concealed malware capable of exposing personal data and granting attackers extended access to victim systems.