Security researchers uncover evidence that the Windows-based ‚RenEngine loader‘ malware has infected around 30,000 users in the US alone.<\/b>
\nA new strain of Windows-based malware has been circulating through pirated PC games and may have infected over 400,000 devices.
Researchers at cybersecurity vendor Cyderes are warning about the threat, which has been hiding inside cracked games and modified game installers for franchises including Far Cry, Need for Speed, FIFA, and Assassin\u2019s Creed.
The malware has been dubbed \u201cRenEngine loader\u201d because some of the malicious code has been embedded inside a legitimate Ren\u2019Py launcher, an engine used to run visual novel games. \u201cWhile these cracked games appear functional, they silently deliver embedded malware alongside the playable content,\u201d the researchers wrote.
The malware has been around since at least last April and remains active. Cyderes also uncovered evidence that the threat has infected over 400,000 victims globally because the malware was updated to include telemetry tracking data back in October. \u201cThe telemetry URL is embedded in the malware and can be reached whenever the malicious RenEngine loader executes,\u201d the researchers added.
The telemetry tracker shows the malware is usually logging about 4,000 to 10,000 visitors per day, with the highest concentration of victims observed in India, the United States, and Brazil, the company\u2019s report adds.
Cyderes points to one site, \u201cdodi-repacks[.]site,\u201d for hosting the malware-laden game downloads. The domain has been previously flagged in other malware campaigns.
The attack also leverages the Ren\u2019Py launcher to archive the pirated game files. Executing the launcher decompresses the game files while secretly kicking off the malware\u2019s installation. Cyderes spotted the RenEngine loader ultimately trying to deliver a Windows-based information stealer called ARC to harvest sensitive data from victim PCs, including \u201csaved browser passwords, cookies, cryptocurrency wallets, and autofill information, along with system details and clipboard contents.\u201d
\u201cIn other similar scenarios, we observed different payloads such as Rhadamanthys stealer, Async RAT, and XWorm delivered via RenEngine Loader,\u201d which can also steal passwords or enable a hacker to remote hijack the PC, Cyderes warned.
Except for Avast, AVG, and Cynet, it appears that most antivirus engines currently don\u2019t recognize the initial stage of the malware as a threat, according to Google\u2019s malware-checking service VirusTotal. Affected users can consider using Windows’s System Restore or reinstalling the OS as a nuclear option if they suspect their PC contains malware.<\/p>\n