A malware loader dubbed RenEngine is spreading through modified games and pirated software, impacting users in Latin America and beyond, according to recent analysis from Kaspersky’s Threat Research team.
First detected in March 2025, RenEngine initially appeared to target gamers using cracked software. Though, researchers have since discovered that cybercriminals have created numerous websites to distribute the loader through various types of pirated software, including professional graphic design programs like CorelDRAW. This expanded distribution method significantly broadens the attack surface, putting users who download unlicensed applications at risk.
Kaspersky began actively blocking RenEngine in March 2025 after initially detecting samples of the malware. The loader functions as a gateway for other malicious software, initially installing Lumma Stealer, designed to steal victim information. More recent campaigns show attackers are now primarily using it to install ACR Stealer, with Vidar Stealer also being distributed in some instances.
The infection process begins with altered versions of games developed using Ren’Py, a popular game engine for creating visual novels – story and image-focused games. This highlights the growing trend of malware hiding within seemingly legitimate software distribution channels.
The discovery underscores the risks associated with downloading software from unofficial sources, even for entertainment purposes. The increasing sophistication of malware distribution methods requires users to exercise caution and prioritize security best practices.
