Fake Game Downloads Deploy RenPy Loader to Deliver Amatera Stealer via MSBuild and EtherHiding
What Happened — Malwarebytes observed multiple campaigns that masquerade as game, mod, or cracked‑software installers. The payload, RenPy Loader, abuses the Ren’Py visual‑novel engine, MSBuild project files, and an “EtherHiding” technique that stores C2 addresses on a public blockchain, ultimately delivering the Amatera infostealer (or related loaders).
Why It Matters for Compliance & Audit Readiness
- The chain exploits legitimate development tools to bypass traditional file‑reputation controls – a scenario SOC 2 access‑control policies are designed to detect and log.
- Stolen browser passwords, crypto‑wallet keys, and session tokens constitute credential‑exfiltration, highlighting the need for robust MFA, least‑privilege access, and continuous monitoring of privileged‑account activity.
- Evidence of such multi‑stage infections must be captured for audit‑ready logs (e.g., endpoint detection alerts, file‑integrity monitoring) to demonstrate control effectiveness.
Who Is Affected – Consumers and employees across all sectors who download software from untrusted sites; particularly high‑risk for organizations that allow personal device use for work (BYOD) or host internal software repositories.
Recommended Actions
- Enforce strict download‑policy controls and block execution of unsigned binaries from non‑whitelisted sources.
- Deploy endpoint detection & response (EDR) with real‑time monitoring of MSBuild and .NET component execution.
- Review and tighten SOC 2 access‑control criteria: MFA for all privileged accounts, credential‑vault usage, and regular credential‑rotation.
- Conduct security‑awareness training focused on “fake‑download” social engineering.
Source: Malwarebytes Labs – Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding
Technical Notes – Attack vector: malicious installers (fake game downloads) → RenPy Loader (abuses Ren’Py engine) → MSBuild project files → trojanized .NET component → EtherHiding (C2 address on blockchain) → Amatera Stealer (browser, crypto‑wallet, messaging app credential theft). No CVE cited; technique relies on legitimate tooling rather than a software flaw.