They warn about ‘RenEngine’, a ‘malware’ loader that is distributed through pirated games and programs

The cybersecurity company Kaspersky has warned about ‘RenEngine’ a ‘malware’ loader hidden in pirated games and programs which has been attacking several countries for almost a year, including Spain.

Kaspersky’s Threat Research team has published a technical analysis of this malware loader, which was first identified in March 2025when they started actively blocking this threat.

Although it was initially thought that its distribution was linked to “cracked” games, Kaspersky analysts have discovered that cybercriminals had created a web page network to spread the malicious ‘loader’ through other programs, such as the CorelDRAW graphic editor.

The ‘RenEngine’ attacks are based on the distribution of ‘malware’ hidden in modified versions of games developed with the engine Ren’Pytypically used in visual novels. When running the infected installer, the user sees a apparently legit loading screen which stops when it reaches one hundred percent, at which point they execute malicious scripts in the background.

These ‘scripts’ include mechanisms to bypass analysis systems and, after being activated, download other cyber threats through the ‘HijackLoader’ toolstarting an infection in several phases.

“Attackers are using the same technique to distribute malware via cracked productivity software, which significantly expands the potential number of victims,” ​​said Pavel Sinenko, senior malware analyst at Kaspersky Threat Research.

Specifically, the company has located this type of threats in Spain, Russia, Brazil, Türkiye or Germanyalthough it has clarified that the distribution pattern points to “opportunistic cyber attacks” rather than organized campaigns against specific targets.

Faced with this threat, Kaspersky has recommended downloading games and software only from official sourcesuse a reliable security solutionkeep the updated operating system and applicationsy be wary of free offers on unofficial channels.