Surge in AI-Driven Phishing Attacks and QR Code Quishing in 2025 Spam and Phishing Report

RenEngine is an active campaign that distributes Lumma and ACR stealers by embedding a multi-stage loader into modified Ren'Py-based game launchers and cracked software. The loader performs sandbox detection, decrypts staged payloads, and uses DLL hijacking (dbghelp.dll) to inject final payloads into trusted processes (e.g., explorer.exe), enabling persistent in-memory theft of passwords, cookies, and cryptocurrency wallets; incidents have been observed in multiple countries.