Rhadamanthys Infostealer Hides in Ren’Py Visual Novel Games, Deploys Malware via Fake 1 Million Second Loading Screen

Researchers at the AhnLab Security Intelligence Center (ASEC) have uncovered a malware campaign in which the Rhadamanthys Infostealer is distributed under the guise of Ren’Py-based visual novels, a popular engine among indie developers. The infection chain begins when users download a supposed “Free Download Files[.]zip” from MediaFire, with a launcher named lnstaIer.exe that silently triggers the Rhadamanthys payload when opened.

The malware embeds malicious scripts in Ren’Py components such as script[.]rpy and __init__.py, allowing it to execute behind the game’s normal interface, and it decompiles a game archive to trigger the modified script[.]rpy which imports an init.py from the Ren’Py directory.

After gathering system information and decrypting a hidden .key file, the malware reveals the payload name, password, and executable filename encoded in Base64 JSON, before creating a temporary folder and launching UIS4tq7P.exe alongside iviewers.dll to inject Rhadamanthys into a .NET process. A deceptive fake loading screen with a nearly one million second delay completes the attack, making the infection feel like a legitimate game load as users in forums for cracked or adult games download the malicious content. 29 October 2025