Hackers Turn Fake Games Into Multi-Stage Infostealers That Steal Passwords and Crypto Wallets

Criminals are using fake game downloads to slip a sophisticated information stealer onto Windows computers.

The campaign hides behind supposed games, mods, cracks, and other software, exploiting the trust and urgency around free or hard-to-find downloads.

A downloaded archive can appear harmless and may even display a loading or installation screen.

Behind that screen, a hidden chain of programs prepares Amatera Stealer, malware built to collect passwords, browser data, cryptocurrency-wallet information, messaging-app data, and local files.

Malwarebytes said in a report shared with Cyber Security News (CSN) that the activity uses RenPy Loader, a multi-stage framework that turns a legitimate game-development engine into a delivery vehicle.

Researchers found the campaign on malicious download sites, game portals, and file-sharing services, where redirects can lead victims through several lookalike pages.

The risk goes beyond a lost game account. Stolen browser credentials and session data can open a route into email, social media, financial services, and business systems, while wallet theft can result in immediate and irreversible losses.

Hackers Turn Fake Games Into Multi-Stage Infostealers

The infection starts when a victim opens Setup.exe from a downloaded archive.

RenPy Loader abuses RenPy, an open-source engine commonly used for visual novels and interactive fiction, to conceal malicious Python-enabled content inside a package that looks related to gaming.

The first stage checks for analysis environments, decrypts a ZIP archive, and writes its contents to a random temporary folder.

It then removes Windows Mark of the Web protection from extracted content and uses forfiles.exe to launch a batch file, making a routine-looking installer the entry point for a much larger operation.

That batch file invokes MSBuild, a legitimate Windows build component, to load a tampered .NET library called Nancy. The library decrypts data, alters network settings, performs anti-forensics activity, and launches another hidden component.

This approach resembles MsBuild abuse in malware, where trusted Windows utilities can be repurposed to mask malicious execution.

The next downloader, GollopDevest.dll, uses EtherHiding to retrieve its command server from blockchain data rather than storing the address directly in the malware.

That complicates takedowns and detection, a tactic also seen in blockchain-based EtherHiding malware technique. It then pulls down additional components that finally decrypt and run Amatera Stealer.

Credentials and Wallets at Risk

Amatera targets information that can be quickly converted into access or money. Browser passwords, cookies, and other session data may let an attacker enter services without repeatedly requesting credentials, while cryptocurrency wallets, extensions, messaging apps, and files expand the possible damage to individuals and organizations.

The payload is not fixed across every RenPy Loader operation. Researchers have previously observed the loader distributing HijackLoader and Lumma Stealer, suggesting operators can change the final malware to suit a campaign.

Readers tracking earlier Amatera Stealer activity or a malicious game cheat package campaign should treat unsolicited gaming downloads as a broader malware-delivery risk. Fake cheats, cracks, and unofficial mods can all provide an effective lure for malware operators.

The practical defense is straightforward: download games and software only from official sites, trusted stores, or established platforms.

Avoid cracked releases and unofficial mods, inspect archives before opening executable files, and leave any download path that bounces through unfamiliar sites or file-sharing pages.

Users should also keep Windows, browsers, and security software updated, because a polished installer or familiar hosting service is not proof that a download is safe.

Organizations can reduce exposure by restricting unapproved software, monitoring unusual MSBuild activity, and resetting exposed passwords promptly.

Security teams should review alerts for unexpected Setup.exe, MSBuild, and forfiles.exe activity after game installations, then preserve suspicious archives for analysis.

Investigation can identify accounts, isolate devices, and prevent stolen sessions from being reused against services.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

! ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposuremalware to businesses an