RenEngine Loader and HijackLoader: Dual-Stage Attack Chain

Our analysis indicates that more than 400,000 global victims have been impacted, with the operation continuing to infect over 5,000 new victims per day. The threat actors blend compelling social‑engineering techniques with a stealthy, multi‑stage execution chain designed to bypass security controls and impede analysis. By embedding a modular, stealth‑focused second‑stage loader inside a legitimate Ren’Py launcher, the attackers closely mimic normal application behavior, significantly reducing early detection.

This campaign is far from a commodity “grab‑and‑go”…