Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Summary
- The Howler Cell Threat Research Team has uncovered an active and highly advanced stealer campaign that has been operating since at least April 2025 and remains ongoing.
- During this investigation, the team identified and named a previously unreported malware family, RenEngine Loader, after discovering malicious logic embedded within what appears to be a legitimate Ren’Py-based game launcher.
- In parallel, the team analyzed a new variant of HijackLoader used in the same campaign.
- This variant introduces several never-before-seen capabilities, including the modules ANTIVMGPU, ANTIVMHYPERVISORNAMES, and ANTIVMMACS.
- Several attack chains also incorporated additional stealer families, such as Vidar and ACR.
A defining characteristic of this campaign is its scale and sophistication. It exploits cracked games, illegally modified game installers that allow users to download and play commercial titles without paying. While these cracked games appear functional, they silently deliver embedded malware alongside the playable content.
Compromised game titles observed in this campaign include:
Article Link: RenEngine Loader and HijackLoader: Dual-Stage Attack Chain Fueling Stealer Campaigns