Malware News The game is over: when “free” comes at too high a price. What Kaspersky knows about RenEngine

[Khushal]

Content source

https://securelist.com/renengine-campaign-with-hijackloader-lumma-and-acr-stealer/118891/

The game is over: when “free” comes at too high a price. What we know about RenEngine

We disclose new details about campaigns involving RenEngine and HijackLoader malware. Since March 2025, attackers have been distributing the Lumma stealer in a complex chain of infections, and in February 2026, ongoing attacks using ACR Stealer became known.

securelist.com

RenEngine is a sophisticated malware loader distributed primarily via pirated games and software, posing significant cybersecurity risks. First detected by Kaspersky solutions in March 2025, RenEngine has since been linked to a widespread campaign that uses game piracy and cracked software as bait to infect victims worldwide. The malware notably delivers payloads such as the Lumma stealer and ACR Stealer, both known trojan stealers aimed at harvesting sensitive user data.


Recommendations for Protection
Avoid downloading pirated games or software from untrusted sources, as these archives often lack standardized integrity checks and may harbor malware.
Use specialized security solutions like Kaspersky Premium with Behavior Detection to identify malicious activity even in modified or unknown malware variants.
Employ modern antivirus technologies capable of detecting known stealers like Lumma, ACR, and Vidar, which are used in this campaign.
Gamers and software users should install software only from trusted and official platforms to minimize infection risk.

 

[Halp2001]

Sometimes what looks like a free feast is actually a poisoned banquet. Like those castles that offer free entry but hide moats and invisible sentinels: crossing the gate can cost more than the gold you were trying to save. The lesson is clear: not everything that shines as ‘free’ is worth tasting.

 

[Halp2001]

Without wanting to go off-topic, but since it is related to Kaspersky, it’s worth mentioning that their data collection policy in Kaspersky Security Network (KSN) has become much more extensive.It now includes not only hashes and technical data, but also Wi-Fi network information, IP addresses, and usage statistics. Although it is presented as an improvement in detection, “marketing purposes” are also mentioned, which raises questions about the real scope.I believe this fits with the idea that “free” can come at too high a price — in this case, privacy — especially when compared with other security software that collects less data.