RenEngine Loader Deploys Stealthy Multi-Stage Execution to Bypass Security Measures

**Executive summary:** A large-scale, ongoing stealer campaign (active since April 2025) abuses Ren'Py game launcher archives distributed via pirated game downloads to deploy a multi-stage loader (RenEngine → evolved HijackLoader) that uses sandbox/VM checks, DLL side‑loading, module stomping, and process doppelgänging to install information stealers (notably ACR Stealer), reportedly compromising ~400,000 victims with ≈5,000 new infections per day and exfiltrating browser credentials, cookies, crypto wallet data, system information, and clipboard contents.