Fake Ren'Py Games Hide Amatera Stealer via EtherHiding

How the Fake Game Campaign Works: RenPy Loader, MSBuild, and EtherHiding Explained

Security researchers at Malwarebytes have uncovered a malware campaign that hides behind something a lot of gamers trust without thinking twice: an indie game built on the Ren'Py engine. Ren'Py is a legitimate, widely used tool for building visual novel style games, which is exactly why it makes such convincing cover. Attackers are packaging a loader, dubbed RenPy Loader, inside game files that look and behave like a normal downloadable title.

Once a victim runs the fake game, the loader quietly abuses MSBuild, a legitimate Microsoft development tool that's already installed on many Windows machines to compile code. Because MSBuild is a trusted, signed Windows component, security tools are less likely to flag activity that runs through it, letting the malicious payload execute with less scrutiny than a standalone executable would draw.

The campaign also leans on a technique called EtherHiding, where malicious code or configuration data is stashed inside blockchain transactions or smart contracts. Instead of hosting instructions on a server that can be taken down or blacklisted, attackers can pull commands from decentralized infrastructure that's much harder for defenders to disrupt. Chaining a trusted game engine, a trusted build tool, and blockchain-based hiding together is what makes this campaign notable: each piece on its own looks unremarkable, but together they form a delivery pipeline for Amatera Stealer.

What Amatera Stealer Actually Takes From Infected Devices

Amatera Stealer is the final payload in this chain, and its job is straightforward: harvest anything valuable from the infected machine. Stealer malware of this type is typically designed to grab saved browser passwords, autofill data, cryptocurrency wallet files, session cookies, and credentials for gaming, email, or social accounts. Once collected, that data is sent back to the attacker, who can sell it, use it for account takeovers, or fold it into further campaigns.

What makes stealers like Amatera dangerous isn't flashy ransomware-style disruption; it's the quiet, silent theft. A victim may keep playing the fake game for days with no visible sign anything is wrong, while login credentials and wallet data are already in someone else's hands. By the time unauthorized logins or drained accounts show up, the malware has often already done its job and moved on.

Why a VPN Doesn't Protect You Once Malware Is Executed

It's worth being clear about something a lot of gamers get wrong: a VPN is not an antivirus and it cannot stop this kind of infection. A VPN encrypts your internet traffic and masks your IP address, which is genuinely useful for privacy, avoiding regional blocks, and reducing exposure on public Wi-Fi. But none of that matters once you've voluntarily downloaded and run a malicious file. The malware executes locally on your device, reads your saved passwords and files locally, and only touches the network when it's ready to exfiltrate what it stole, at which point a VPN just encrypts the theft in transit rather than preventing it.

This distinction matters even for gamers who already use a VPN for legitimate reasons, like reducing latency or accessing region-locked content. If you're researching options for a specific game, resources like a Best VPN for Roblox guide can help with connection quality and unblocking, but that's a separate decision from protecting yourself against credential-stealing malware. The two problems require different tools: a VPN for network-level privacy, and safe downloading habits plus endpoint security for malware.

Safe Download Practices for Gamers to Avoid Credential-Stealing Malware

Because this campaign relies on tricking players into running a file, the strongest defense is behavioral, not technical. A few habits go a long way:

• Only download games from official storefronts or the developer's verified website, and be skeptical of links shared in Discord servers, forum posts, or unsolicited DMs asking you to "try a game."
• Check file properties and digital signatures before running unfamiliar executables, especially ones bundled with a game engine like Ren'Py that you wouldn't normally expect to need separate build tools.
• Keep antivirus and endpoint protection active and updated, since it can catch known stealer signatures even when the delivery method is novel.
• Be wary of games that request unusual permissions or trigger unexpected background processes, including anything invoking MSBuild or similar development tools you didn't install yourself.
• Use unique, strong passwords stored in a reputable password manager rather than saved in a browser, so a single stealer infection can't unlock every account you own.

What This Means For You

The fake games malware stealer campaign described here is a reminder that trust in a familiar tool, whether it's a game engine, a build utility, or a blockchain, can be weaponized by attackers who understand how defenders look for threats. Gamers don't need to panic, but they do need to treat unofficial downloads with the same caution they'd apply to email attachments from strangers.

Final Takeaways

Stick to verified sources for game downloads, keep security software current, and remember that a VPN protects your connection, not your device. If something asks you to run an installer from an unfamiliar link, pause and verify before you click. That single habit is more effective against campaigns like this one than any single piece of security software.