People hunting for free games, mods, or cracked software are being funneled into a stealthy malware chain that ends with their passwords and crypto wallets stolen, according to researchers at Malwarebytes. The campaigns hide a loader inside downloads built with Ren'Py, a legitimate open-source engine for visual-novel games, so a malicious installer looks like an ordinary title while it quietly runs code in the background.
The final payload is Amatera Stealer, an infostealer that raids passwords and data saved in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session tokens can then let attackers walk straight into the victim's online accounts. The same loader, sometimes called RenEngine Loader, has also been seen dropping HijackLoader and Lumma Stealer, so the end payload varies by campaign.
Where the fake downloads live
Malwarebytes found the malicious files spread through fake download sites, itch.io pages, and file-sharing services including Wormhole, GoFile, Google Drive, and MEGA. Clicking a download link often bounces the user through several throwaway sites with invented service names, which helps the operation blend in and dodge takedowns. The victim downloads an archive containing a file named Setup.exe, sees a convincing installation screen, and never notices the infection running underneath.
How the attack works
The chain is deliberately convoluted to frustrate analysts. The Ren'Py stage decrypts a hidden ZIP, drops a batch file and several MSBuild project files, then abuses Microsoft's own MSBuild build tool to reflectively load a trojanized version of the Nancy .NET library. Along the way it strips the Mark of the Web to bypass SmartScreen and checks for sandboxes before continuing.
The most novel step is how the malware finds its command server. Instead of hard-coding an address that defenders can block, a downloader called GollopDevest uses a technique known as EtherHiding: it reads its encrypted command-and-control domain from data stored on the BNB Smart Chain public blockchain, querying it like any ordinary crypto app. Because the address lives on a decentralized ledger, it is far harder to seize or take offline. From there the malware pulls additional obfuscated payloads that finally decrypt and launch Amatera Stealer. This abuse of trusted developer tools echoes other campaigns that push stealers through trojanized installers and fake-fix prompts.
How to stay safe
- Download games and software only from official stores and established platforms; treat cracks, unofficial mods, and free versions of paid games as high risk.
- Be wary when a download link redirects you through several unfamiliar sites or file-sharing services.
- Inspect archive contents before running any Setup.exe, and watch for odd filenames or files unrelated to what you meant to download.
- Keep your operating system, browser, and security software patched and running.
Selected indicators
Malwarebytes lists fake-download and distribution domains including downpro[.]net, getgamerfree[.]com, and fullgames[.]digital, the Amatera command server at login[.]orbitalframework[.]cc, and payload-hosting IPs 144[.]124[.]251[.]171, 195[.]63[.]140[.]33, and 78[.]40[.]196[.]252. The final-payload MD5 f8453efe408ce25b9484f872797e3d63 rounds out the salient indicators.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.