Fake game installs spread RenPy Loader, dropping Amatera Stealer

The article discusses how fake game downloads are being used to distribute malware known as **RenPy Loader**, which subsequently delivers **Amatera Stealer**, an infostealer targeting sensitive information. RenPy Loader exploits the legitimate Ren’Py game engine, disguising malicious code within game installers to trick users. The article outlines the infection process, which starts with downloading a fake game or software, often from suspicious websites or file-sharing services.

Once installed, the malware runs silently in the background while it executes a multi-stage infection chain using techniques such as **MSBuild** and **EtherHiding**. The latter involves hiding command-and-control server addresses in a public blockchain to evade detection. Precautions are suggested for users to avoid falling victim to such threats, including downloading only from official sources and using reliable antivirus software. The article also provides indicators of compromise, detailing malicious domains, IP addresses, and file hashes associated with the malware.