Fake Game Downloads Deliver Amatera Stealer via Ren'Py Loader, MSBuild Abuse, and EtherHiding C2
Fake Game Downloads Deliver Amatera Stealer via Ren'Py (TL-2026-1569), also tracked as RenPy Stealer Campaign, is a high-severity malware campaign, first published 2026-07-20. It has no confirmed attribution, affects Ren'Py Ren'Py Visual Novel Engine, maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 54 indicators of compromise.
Key facts for TL-2026-1569
- Threat ID
- TL-2026-1569
- Also known as
- RenPy Stealer Campaign, Ren'Py Loader / MSBuild / EtherHiding Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- generalconsumer, gaming
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 54
Malware and tooling in Fake Game Downloads Deliver Amatera Stealer via Ren'Py
Malware and tooling: Amatera Stealer, GollopDevest, HijackLoader, LanoseThrip, Lumma Stealer - S1213, PavinWide, RenPy Loader, EtherHiding (smart contract 0x328a1fadff154290f0ce1389a4e633698cdfdaa7, method 0x06fdde03 via bsc-dataseed.binance.org), MSBuild.exe
A malware-as-a-service campaign lures victims through fake game/software download sites and itch.io pages, trojanizing the Ren'Py visual novel engine to trigger a multi-stage MSBuild-abusing .NET loader chain (Nancy DLL -> GollopDevest -> PavinWide -> LanoseThrip) that deploys Amatera Stealer (or HijackLoader/Lumma Stealer). The campaign resolves its C2 domain via an Ethereum/BSC smart-contract lookup (EtherHiding), evading static-infrastructure takedowns.
How Fake Game Downloads Deliver Amatera Stealer via Ren'Py works
Malwarebytes documented an active malware-as-a-service (MaaS) campaign in which threat actors distribute trojanized game/software installers through fraudulent download sites, itch.io pages, and file-sharing services (Wormhole, GoFile, Google Drive, MEGA). The lure archive contains a Setup.exe that launches a trojanized Ren'Py visual novel engine (the RenPy Loader / RenEngine Loader), which embeds malicious Python bootstrap code inside the legitimate libwin32.rpa Ren'Py package.
The RenPy Loader decrypts a Base64/XOR-encoded configuration file (key 81034149cd6f48c8821340204f92766e) and a second XOR-encrypted ZIP archive (key A50YyY1, filename j3lpTcg7kBRN.E3), performs sandbox-evasion checks via sys_config.is_sandboxed(), strips the Mark-of-the-Web alternate data stream (Zone.Identifier / ZoneId=0) to defeat SmartScreen, and injects random REM junk lines into an extracted BAT file (TP2hppNk5.bat) for obfuscation before execution via forfiles.exe.
The BAT script relaunches itself in a hidden conhost.exe --headless console, sets the environment variable MSBUILDENABLEALLPROPERTYFUNCTIONS=1, and abuses the legitimate, code-signed Microsoft build tool MSBuild.exe (Microsoft.NET\Framework\v4.0.30319\MSBuild.exe) to execute a malicious inline-task project, Nancy.csproj, alongside companion files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. These three files concatenate a hex-encoded DLL payload split across them, which MSBuild's inline C# task compiles and loads in-memory via AppDomain.CurrentDomain.Load / CreateInstance, invoking a class method named DefaultEvaluator5 — a textbook living-off-the-land binary (LOLBin) technique that evades disk-based AV signatures.
The resulting first-stage payload is a heavily obfuscated, trojanized clone of the legitimate open-source Nancy .NET web framework library. It implements a custom bytecode interpreter (Nancy.Runtime.mvlorimu resource, 23 custom opcodes) used to decrypt embedded strings via a multi-key XOR/S-box scheme (out[j] = data[j] XOR key1[j%b] XOR sbox[(j*m1+seed)&0xFF] XOR key2[...]), resolves Windows APIs by hash via GetDelegateForFunctionPointer, disables TLS certificate validation, manipulates the system proxy, and performs anti-forensic cleanup. It reads the _czzf environment variable (pointing back to Nancy.csproj) and decodes/executes the next stage: the GollopDevest downloader DLL.
GollopDevest implements the campaign's signature innovation, EtherHiding: rather than hardcoding a C2 domain, it issues an Ethereum JSON-RPC eth_call (method selector 0x06fdde03, the ERC-20 'name()'/string() function) against a Binance Smart Chain node (bsc-dataseed.binance.org) targeting smart contract 0x328a1fadff154290f0ce1389a4e633698cdfdaa7, decoding the returned string to obtain the live C2 address. This mirrors the EtherHiding technique publicly attributed to DPRK actor UNC5342 in Contagious Interview campaigns, giving the operators a censorship-resistant, cheaply-updatable C2 pointer (contract updates cost roughly $1.37 in gas per change in prior EtherHiding campaigns) that survives domain/IP takedowns.
GollopDevest downloads three further payloads from attacker infrastructure (paths /assets/ExponeAboard.json, /assets/MailersKogasin.json, /assets/LanoseThrip.json): PavinWide (an anti-analysis/anti-sandbox DLL), a second-stage GollopDevest loader DLL, and LanoseThrip (a C++ DLL wrapper) that decrypts and loads the final payload, Amatera Stealer, reaching out to C2 login.orbitalframework[.]cc.
Amatera Stealer is itself a rebrand of ACR (AcridRain) Stealer, a MaaS C++ information stealer whose source was sold in 2024; the current version targets roughly 65 browsers and 137 desktop cryptocurrency wallets, harvests credentials, session cookies, messaging-app credentials, local files, and browser-extension data, and (per parallel eSentire/Proofpoint reporting from mid-2026) has moved from AES-256-CBC to an ECDH (NIST P-256) + ChaCha20-Poly1305 scheme for C2 traffic protection to defeat network inspection. Malwarebytes also observed the same distribution chain alternately delivering HijackLoader or Lumma Stealer as final payloads, consistent with a MaaS affiliate model where the loader-for-hire chain is payload-agnostic. GollopDevest itself has been observed in unrelated campaigns including ClickFix-style fake-CAPTCHA lures, indicating it is a shared/rented loader component rather than bespoke to this campaign.
The overall chain — Ren'Py engine abuse for initial execution, MSBuild.exe LOLBin abuse for in-memory .NET payload compilation/execution, and EtherHiding for resilient C2 resolution — represents a novel combination of techniques aimed opportunistically at gamers, software-piracy seekers, and mod/cracked-software downloaders, ultimately targeting credentials and cryptocurrency wallets.
MITRE ATT&CK techniques used in TL-2026-1569
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.014 MMC; T1497 Virtualization/Sandbox Evasion; T1564.004 NTFS File Attributes; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.003 Windows Command Shell; T1059.006 Python; T1106 Native API; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1568 Dynamic Resolution
Discovery
T1082 System Information Discovery
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Initial Access
T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment
discovery
T1518.001 Security Software Discovery
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Persistence
Affected products and versions in Fake Game Downloads Deliver Amatera Stealer via Ren'Py
- Ren'Py — Ren'Py Visual Novel Engine
Vulnerable versions: all versions abused as a loader vector - Microsoft — MSBuild (.NET Framework v4.0.30319)
Vulnerable versions: all versions supporting inline tasks / property functions - Microsoft — Windows (all supported desktop versions)
Vulnerable versions: all
Remediation for Fake Game Downloads Deliver Amatera Stealer via Ren'Py
Immediate actions
- Block all listed fake-download and distribution domains at DNS/proxy/firewall
- Block outbound traffic to login.orbitalframework[.]cc and the listed delivery IPs
- Hunt for MSBuild.exe execution with unusual command-line arguments referencing .csproj/.props/.targets files outside normal build environments
- Hunt for MSBUILDENABLEALLPROPERTYFUNCTIONS=1 environment variable usage
- Alert on conhost.exe spawned with --headless argument
- Search endpoints for forfiles.exe invocations chained from archive extraction paths
- Isolate and reimage any host that executed an unsigned Setup.exe from a game/mod download site
Workarounds
- Restrict or monitor MSBuild.exe via Windows Defender Application Control / AppLocker path rules
- Enforce Mark-of-the-Web (Zone.Identifier) integrity checks and block execution of files with stripped ADS from archive extraction tools
Longer-term hardening
- Deploy application allowlisting to prevent MSBuild.exe execution outside CI/build contexts
- Deploy EDR behavioral rules for in-memory .NET assembly loading via AppDomain.Load/CreateInstance from MSBuild-spawned processes
- Monitor for Ethereum/BSC JSON-RPC calls (eth_call) originating from consumer endpoints, a strong indicator of EtherHiding-style C2 resolution
- User awareness training on risks of cracked software, game mods, and unofficial itch.io/file-sharing downloads
- Deploy browser and crypto-wallet credential-store hardening (OS keychain / hardware wallet usage) to reduce stealer impact
Timeline of Fake Game Downloads Deliver Amatera Stealer via Ren'Py
- Guardio Labs researchers Nati Tal and Oleg Zaytsev publish the original 'EtherHiding' research, describing malicious code hidden inside Binance Smart Chain contracts to serve payloads for compromised-WordPress fake-browser-update campaigns — the origin of the C2-hiding technique this campaign later reuses.
- Google Threat Intelligence Group observes DPRK-linked actor UNC5342 begin using EtherHiding in Contagious Interview social-engineering campaigns, marking the first known state-backed adoption of blockchain-based C2 hiding; the smart contract is updated over 20 times in the following four months at roughly $1.37 gas cost per update.
- Google Threat Intelligence Group and BleepingComputer publicly disclose UNC5342's EtherHiding smart-contract C2 technique, establishing the technique later adopted by this campaign's GollopDevest component.
- ACR (AcridRain) Stealer, sold as source code in 2024, continues rebranding as Amatera Stealer with expanded browser/wallet targeting and ECDH+ChaCha20-Poly1305 network hardening.
- In late April 2026, eSentire's Threat Response Unit intercepts an attempted Amatera Stealer delivery within a customer environment in the Finance industry.
- Microsoft Defender Experts observe increased ACR/Amatera Stealer activity across customer environments from late April through mid-June 2026.
- eSentire TRU publishes 'Amatera Stealer 4.0.2 Beta: What's New in This Variant,' detailing the shift from hard-coded-key AES-256-CBC to ECDH (NIST P-256) + ChaCha20-Poly1305 for C2 traffic protection since its prior November 2025 report.
- Fake game-download campaign using RenPy Loader, MSBuild abuse, and EtherHiding C2 resolution observed actively distributing Amatera Stealer, HijackLoader, and Lumma Stealer via itch.io and file-sharing services.
- Malwarebytes blog post 'Fake games spread stealers with RenPy loader, MSBuild, and EtherHiding' published by Gabriele Orini.
- Malwarebytes ThreatDown publishes full technical analysis of the RenPy Loader / MSBuild / EtherHiding campaign, including complete IOC set.
Sources cited for Fake Game Downloads Deliver Amatera Stealer via Ren'Py
- Fake games spread stealers with RenPy loader, MSBuild, and EtherHiding
- Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication
- Amatera Stealer 4.0.2 Beta: What's New in This Variant
- SVG Phishing hits Ukraine with Amatera Stealer, PureMiner
- Amatera (Malware Family) - Malpedia
- Novel fake CAPTCHA chain delivering Amatera Stealer
- North Korean hackers use EtherHiding to hide malware on the blockchain
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
- The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain
- Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory
- "EtherHiding" — Hiding Web2 Malicious Code in Web3 Smart Contracts
Threats related to Fake Game Downloads Deliver Amatera Stealer via Ren'Py
- ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
- EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
- Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography
- PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer
- Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
- Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)
Detection coverage for TL-2026-1569
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1569 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.