Cybercriminals are increasingly leveraging fake game downloads to install sophisticated information-stealing malware on Windows systems. This campaign exploits the allure of free or hard-to-find software, masking its true intent behind seemingly harmless downloads.
Malicious Software Hidden in Game Downloads
These deceptive downloads often appear as legitimate games, mods, or software. Once installed, they initiate a hidden chain of programs designed to deploy the Amatera Stealer. This malware is capable of collecting sensitive information such as passwords, browser data, cryptocurrency wallet info, and local files.
According to a report by Malwarebytes, shared with Cyber Security News, the operation uses RenPy Loader, a framework that repurposes a legitimate game development engine to deliver malware. This campaign has been identified on various malicious download sites, game portals, and file-sharing services, where users are often redirected through multiple deceptive pages.
The Mechanics of the Infection Process
The infection begins when a user opens a seemingly innocuous Setup.exe file from a downloaded archive. RenPy Loader takes advantage of RenPy, an open-source engine, to hide malicious Python content within a package that appears gaming-related.
Initially, the malware checks for analysis environments, decrypts a ZIP archive, and writes its contents to a temporary folder. It then removes Windows’ Mark of the Web protection and uses forfiles.exe to execute a batch file, setting the stage for further malicious operations.
This batch file calls upon MSBuild, a legitimate Windows utility, to load a tampered .NET library named Nancy. This library decrypts data, alters network settings, and launches additional hidden components, resembling techniques used in MsBuild abuse malware.
Targeting Sensitive Data
The Amatera Stealer targets information that can quickly be monetized. By extracting browser passwords, cookies, and session data, attackers can gain unauthorized access to various services. Cryptocurrency wallets and messaging apps are also at risk, potentially leading to significant financial and personal data loss.
The payload delivered by RenPy Loader can vary, with past instances distributing different types of malware like HijackLoader and Lumma Stealer. This flexibility allows cybercriminals to adapt their tactics to different campaigns.
Users and organizations are urged to be cautious with gaming downloads, especially unsolicited ones. Fake cheats, cracks, and unofficial mods pose significant risks as malware carriers.
Preventative Measures and Best Practices
To mitigate these threats, it is crucial to download games and software only from official websites, trusted stores, or well-established platforms. Avoid cracked releases and unofficial mods, inspect archives before opening executable files, and avoid download paths that lead through unknown sites.
Regular updates of Windows, browsers, and security software are essential, as a polished installer does not guarantee safety. Organizations can further reduce exposure by restricting unauthorized software installations, monitoring unusual MSBuild activity, and quickly resetting exposed passwords.
Security teams should investigate unexpected Setup.exe, MSBuild, and forfiles.exe activities following game installations and preserve suspicious files for analysis. This proactive approach can help identify compromised accounts and prevent further misuse of stolen data.
