Free games, cracks, and mods have always been a favorite lure for malware operators, and a newly documented campaign shows just how far that trick has evolved. Researchers at Malwarebytes have detailed a multi-stage infection chain that hides behind fake game downloads to deliver Amatera Stealer, malware built to harvest passwords, browser data, cryptocurrency wallets, messaging-app information, and local files from Windows systems.

A Familiar Lure, a More Sophisticated Delivery Chain

The campaign relies on a framework researchers are calling RenPy Loader, which repurposes RenPy — a legitimate, open-source engine widely used to build visual novels and interactive fiction — as a delivery vehicle for Python-enabled malicious content. Victims find these fake downloads on malicious download sites, game portals, and file-sharing services, sometimes after being bounced through several lookalike redirect pages before landing on the final archive.

Once downloaded, the archive can look entirely ordinary, sometimes even showing what appears to be a normal loading or installation screen while the real infection happens in the background.

Inside the Infection Chain

The attack begins the moment a victim runs Setup.exe from the downloaded archive. From there, the loader works through several distinct stages:

• The first stage checks whether it’s running inside a security researcher’s sandbox or analysis environment, then decrypts a ZIP archive and writes its contents to a randomly named temporary folder
• It strips Windows’ Mark of the Web protection from the extracted files, a flag that would otherwise warn the operating system the content came from the internet
• It uses forfiles.exe, a legitimate Windows utility, to quietly launch a batch script
• That script calls on MSBuild, another trusted Windows build tool, to load a tampered .NET library disguised as a component called Nancy
• The tampered library decrypts additional data, modifies network settings, performs anti-forensic cleanup, and launches the next hidden stage

That next stage, a downloader named GollopDevest.dll, uses a technique called EtherHiding to fetch its command-and-control address from blockchain data rather than hardcoding it into the malware. That makes the infrastructure considerably harder to take down or block, since there’s no fixed server address for defenders to blocklist. The final stage decrypts and executes Amatera Stealer itself.

Why Living-Off-the-Land Tools Matter Here

Nearly every step of this chain leans on tools that already exist on a typical Windows machine — MSBuild, forfiles.exe, and legitimate DLL-loading mechanisms — rather than dropping obviously suspicious executables. That “living off the land” approach is a big part of why the campaign can slip past both users and some automated defenses: the individual building blocks all look like normal system activity.

What’s Actually at Stake

Amatera Stealer is built to grab the data attackers can convert into money or access fastest, including:

• Browser-stored passwords, cookies, and session tokens, which can let attackers walk into other accounts without needing to steal a password directly
• Cryptocurrency wallets and browser wallet extensions
• Messaging-app data and local files

Losses here go well beyond a hijacked game account — stolen session cookies can open a path into email, social media, and financial accounts, while wallet theft is typically immediate and irreversible. Researchers also note that RenPy Loader isn’t married to Amatera specifically; the same delivery chain has previously been observed distributing other malware families, including HijackLoader and Lumma Stealer, meaning operators can swap the final payload depending on the campaign.

Reducing the Risk

The core defense against this kind of campaign is unglamorous but effective: download games and software only from official storefronts or verified publishers, and treat cracked releases, unofficial mods, and cheat packages as inherently risky, regardless of how polished the hosting page looks. Beyond that, users and organizations should:

• Inspect downloaded archives before running any executable inside them
• Avoid download paths that redirect through unfamiliar third-party sites
• Keep Windows, browsers, and endpoint security software up to date
• Monitor for unusual MSBuild or forfiles.exe activity following software installations
• Restrict unapproved software on managed devices and reset credentials promptly if exposure is suspected

Security teams investigating a suspected infection should preserve the original archive and installer for analysis, check for unexpected persistence entries created via the Windows Run key, and treat any accounts or sessions active on the affected machine as potentially compromised until proven otherwise.