Do Son 
A fake download page
Attackers are hiding malware inside fake game and software installers. Malwarebytes Labs calls the threat RenPy Loader. Once it runs, the loader starts a multi-stage chain that ends in Amatera Stealer. Victims see a normal install screen while malicious code runs in the background.
At a glance
| Malware family | RenPy Loader (also RenEngine Loader), delivering Amatera Stealer |
| Threat actor | Not named. Likely tied to a malware-as-a-service operation |
| Target / victims | People seeking games, mods, cracks, and free software |
| Delivery vector | Fake download sites, itch.io pages, and file-sharing services |
| Key capabilities | Anti-sandbox checks, MSBuild abuse, EtherHiding C2, credential and wallet theft |
| Source | Malwarebytes Labs Threat Intelligence |
TL;DR
RenPy Loader abuses the legitimate Ren’Py game engine to look believable. It chains MSBuild abuse and a blockchain-based EtherHiding trick to hide its infrastructure. The final payload steals passwords, wallets, and session data.
Delivery
The bait is simple: a promised game, mod, crack, or app. Malwarebytes found the lures spread through fake download websites, itch.io pages, and file-sharing services like MEGA and Google Drive. Some links bounced users to other fake sites with new names and designs. As the researchers note, this helps the campaigns “appear less repetitive” and makes the infrastructure harder to spot.
Each download holds an archive with a Setup.exe file. Opening it starts the chain. Meanwhile, a fake loading screen keeps the victim distracted.
Infection chain
Abusing a game engine
Ren’Py is a real, open-source engine for visual novels. It allows embedded Python scripts. Attackers abuse that feature to insert malicious code. As Malwarebytes puts it, “attackers abuse legitimate technology to disguise malicious activity.”
From loader to MSBuild
The first stage runs sandbox checks and exits on analysis machines. Next, it decrypts a bundled ZIP. That archive holds a batch file and several MSBuild project files. The chain then runs MSBuild with a trojanized project. During project evaluation, a malicious property function decodes and loads the next .NET stage. In short, a trusted developer tool does the dirty work.
Command-and-control and data theft
The later stage is a .NET downloader that uses EtherHiding. Instead of storing a server address in the file, the malware hides it on a public blockchain. It reads that data through a normal blockchain query, then pulls the next stages. This design makes the RenPy Loader infrastructure harder to identify and take down.
Further payloads follow, including an anti-analysis DLL and a component that loads Amatera Stealer. Amatera then targets browser passwords, cryptocurrency wallets, extensions, and messaging apps. Stolen session data can also unlock the victim’s online accounts.
Attribution
Malwarebytes does not name a specific actor. The EtherHiding downloader appears in other campaigns, including ClickFix lures. Therefore, the report treats it as a likely malware-as-a-service component. Attribution stays open, and the final payload varies; RenPy Loader has also dropped HijackLoader and Lumma Stealer.
Defense and detection guidance
Caution beats cleanup here. Read the full Malwarebytes analysis of RenPy Loader and Amatera Stealer for detailed indicators.
- Avoid cracked games, mods, and “free” software from unofficial sites.
- Treat itch.io and file-share links with care, and verify the publisher first.
- Alert on MSBuild.exe running from user temp folders with unusual project files.
- Watch for processes that reach blockchain RPC endpoints without a clear reason.
- Flag Mark-of-the-Web removal and headless console relaunches during installs.
Indicators here are descriptive only. File names and paths shift between campaigns. So focus on behavior, and enable strong endpoint protection.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
