Editor’s note: In the ongoing battle against malware, RenEngine’s reach underscores how attackers exploit trusted software channels to broaden their victim base. Today’s briefing from Kaspersky Threat Research highlights a multi-stage infection that pivots beyond gaming into widely used cracked productivity tools. The findings emphasize the importance of verifying software sources and maintaining updated defenses across personal and corporate environments. As cyber threats increasingly blend with legitimate workflows, readers should review security practices, stay vigilant about unofficial installers, and consider how threat actors opportunistically adapt to new distribution methods. This update offers context for executives, IT teams, and security professionals navigating a rapidly evolving threat landscape.

Key points

• RenEngine loader is distributed via dozens of pirated software sites, not just cracked games.
• Final payloads include Lumma, ACR Stealer, and Vidar in various infection chains.
• The distribution pattern is opportunistic and regional rather than targeted.
• The campaign uses Ren’Py-based game installers with fake loading screens to deploy malware

Why this matters

The expansion from gaming to cracked productivity software widens the potential victim pool and raises risk for individuals and organizations. Attackers use multi-stage delivery, anti-analysis checks, and broad distribution to bypass defenses. Organizations should reinforce software provenance checks, user education, and behavior-based detection to identify malicious activity masquerading as legitimate software.

What to watch next

• Watch for new distribution sites or bundles carrying RenEngine via cracked software.
• Monitor for updates from security vendors on HijackLoader-based campaigns across multiple payloads.
• Track any new payload families linked to RenEngine or related loaders.

Disclosure: The content below is a press release provided by the company/PR representative. It is published for informational purposes.

Kaspersky identifies RenEngine loader distributed through pirated games and software

Kaspersky identifies RenEngine loader distributed through pirated games and software

February 23, 2026

Kaspersky Threat Research has revealed its analysis of RenEngine, a malware loader that has recently gained public attention. Kaspersky identified RenEngine samples as early as March 2025, with its solutions already protecting users from the threat at that time.

Beyond the cracked games highlighted in recent reports, Kaspersky researchers discovered that attackers created dozens of websites distributing RenEngine through pirated software, including graphics editors like CorelDRAW. This expands the known attack surface beyond the gaming community to anyone seeking unlicensed software.

Kaspersky has recorded incidents in Russia, Brazil, Turkey, Spain and Germany, among other countries. The distribution pattern indicates opportunistic attacks rather than targeted operations.

When Kaspersky first identified RenEngine, the loader was delivering the Lumma stealer. Current attacks distribute ACR Stealer as the final payload, and Vidar stealer has also been observed in some infection chains.

The campaign exploits modified versions of games built on the Ren’Py visual novel engine. When users launch infected installers, a fake loading screen appears while malicious scripts execute in the background. The scripts include sandbox detection capabilities and decrypt a payload that initiates a multi-stage infection chain using HijackLoader, a modular malware delivery tool.

“This threat extends beyond pirated games — attackers are using the same technique to distribute malware through cracked productivity software, which broadens the potential victim pool significantly.”

— Pavel Sinenko, lead malware analyst at Kaspersky Threat Research

“Game archive formats vary by engine and title. If an engine doesn’t check the integrity of its resources, attackers can embed malware that executes the moment you click play.”

Kaspersky solutions detect RenEngine as Trojan.Python.Agent.nb and HEUR:Trojan.Python.Agent.gen. HijackLoader is detected as Trojan.Win32.Penguish and Trojan.Win32.DllHijacker.

To stay protected, Kaspersky recommends:

• Download games and software only from official sources. Pirated content remains one of the most common malware delivery methods.
• Use a reliable security solution. Kaspersky Premium protects against threats like RenEngine through its Behavior Detection component, which identifies malicious activity even when malware is disguised as legitimate software.
• Keep your operating system and applications updated to ensure known vulnerabilities are patched.
• Be skeptical of “free” offers. If a paid game or software is available for free download on an unofficial site, the cost is likely your security.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure, and governments around the globe. The company’s comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

Bitcoin’s (BTC) weakness extended into the weekly open as major stocks sold off in response to US President Donald Trump’s threat to enforce a 15% global tariff after the Supreme Court ruled that his IEEPA tariffs were illegal.

Market sentiment remains fragile, as the Crypto Fear & Greed Index at 5 out of 100 remains in the “extreme fear” zone. Pseudonymous trader and investor BitcoinHyper said in a post on X that the index has been in the extreme fear zone for nearly three weeks, the longest since 2022.

Traders on the prediction market Polymarket have increased the odds of BTC falling below $55,000 to 72%. The prediction market expectations matches several analysts and financial institutions who expect a fall near or below $55,000.

While a bottom may not have formed, expectations are that BTC will eventually recover and move higher. Economist Timothy Peterson said in a post on X that BTC has been positive 50% of the time in the past 24 months. Using a statistical model, Peterson estimated that there is an 88% chance that BTC “will be higher 10 months from now.” 

Could buyers defend the support levels in BTC and the major altcoins? Let’s analyze the charts of the top 10 cryptocurrencies to find out. 

S&P 500 Index price prediction

The S&P 500 Index (SPX) has been trading between 6,775 and 7,002 for several days, indicating a balance between supply and demand.

The flat moving averages and the relative strength index (RSI) near the midpoint do not give a clear advantage either to the bulls or the bears. Buyers will have to achieve a close above the 7,002 resistance to signal the resumption of the uptrend. The index may then ascend to the 7,290 level.

This bullish view will be invalidated in the near term if the price turns down and breaks below the 6,775 level. The index may then tumble to the solid support at the 6,550 level.

US Dollar Index price prediction

The US Dollar Index (DXY) turned down from the 50-day simple moving average (97.95) on Friday, indicating that the bears are aggressively defending the level.

Sellers are attempting to sink and maintain the index below the 20-day exponential moving average (97.48). If they manage to do that, the index might slide to the 96.21 to 95.55 support zone.

Buyers are likely to have other plans. They will attempt to halt the pullback and push the price above the 50-day SMA. If they can pull it off, the index may jump toward the 99.50 level and subsequently to the 100.54 resistance.

Bitcoin price prediction

BTC fell below the $65,118 support on Monday, but the bulls are attempting to defend the level on a closing basis.

Any relief rally is expected to face selling at the 20-day EMA ($70,185). If the Bitcoin price turns down sharply from the 20-day EMA, it increases the likelihood of a drop to the vital $60,000 support. Buyers will have to defend the $60,000 level with all their might, as a break below it may sink the BTC/USDT pair to $52,500.

Buyers will have to propel the price above the 20-day EMA to signal demand at lower levels. The pair may then march to the $74,508 level, where the bears are again likely to pose a strong challenge.

Ether price prediction

Ether (ETH) fell below the nearby support at $1,897 on Monday, opening the doors for a retest of the $1,750 level.

The downsloping moving averages and the RSI near the oversold territory heighten the risk of a breakdown. If the $1,750 level is taken out, the ETH/USDT pair may resume the downtrend toward the next support at $1,537.

Contrarily, if the Ether price turns up sharply from $1,750, it suggests demand at lower levels. That may keep the pair inside the $1,750 to $2,111 range for a while longer. A close above $2,111 will be the first sign of strength, clearing the path for a rally to the 50-day SMA ($2,593).

XRP price prediction

XRP (XRP) has been trading between the support line of the descending channel pattern and the 20-day EMA ($1.47) for the past few days.

The downsloping 20-day EMA and the RSI in the negative territory indicate that the bears remain in control. If the support line cracks, the XRP/USDT pair may retest the Feb. 6 low of $1.11. A break and close below the $1.11 level may extend the decline to psychological support at $1.

Buyers have an uphill task ahead of them. They will have to swiftly propel the XRP price above the downtrend line to signal a potential trend change.

BNB price prediction

BNB (BNB) fell below the immediate support at $587 on Monday, but the long tail on the candlestick shows buying at lower levels.

The bulls will attempt to start a recovery, which is expected to face selling at the 20-day EMA ($651). If the price turns down from the 20-day EMA, the bears will again strive to pull the BNB/USDT pair below the $570 level. If they manage to do that, the BNB price may start the next leg of the downtrend to psychological support at $500.

Contrary to this assumption, if buyers pierce the 20-day EMA, the pair may rally to the breakdown level of $730.

Solana price prediction

The failure of the bulls to push Solana (SOL) to the breakdown level of $95 signals that the bears are active at higher levels.

Sellers will attempt to strengthen their position by pulling the Solana price below the $76 level. If they succeed, the SOL/USDT pair may fall to the Feb. 6 low of $67, which is a critical support to watch out for. If the level gives way, the pair may slump to $60.

Any relief rally is expected to face resistance at the 20-day EMA and then at the $95 level. A close above the $95 level suggests that the sellers are losing their grip. The pair may then surge to $117.

Related: Bitcoin traders diverge over BTC price strength with $60K in sight

Dogecoin price prediction

Dogecoin (DOGE) turned down from the 20-day EMA ($0.10) on Saturday and is likely to drop to the Feb. 6 low of $0.08.

The bulls are expected to fiercely defend the $0.08 level, as the failure to do so may start the next leg of the downward spiral toward $0.06.

The 20-day EMA remains the immediate near-term resistance to watch out for. A close above the 20-day EMA will be the first sign that the selling pressure is reducing. The DOGE/USDT pair may then ascend to the breakdown level of $0.12, where the bears are expected to mount a strong defense.

Bitcoin Cash price prediction

Buyers pushed Bitcoin Cash (BCH) above the 50-day SMA ($571) on Sunday but could not sustain the higher levels.

The bears sold aggressively and have pulled the Bitcoin Cash price below the 20-day EMA ($551). If the price maintains below $538, the BCH/USDT pair might plummet to the strong support at $500. Buyers are expected to aggressively defend the $500 level, as a close below it may sink the pair to $443.

Buyers will have to drive and maintain the price above the 50-day SMA to signal strength. The pair may then climb to $600.

Cardano price prediction

Despite repeated attempts, buyers failed to push and maintain Cardano (ADA) above the 20-day EMA ($0.28) in the past few days. 

That increases the likelihood of a drop to the support line of the descending channel pattern. If the price rebounds off the support line and breaks above the 20-day EMA, it suggests that the ADA/USDT pair may remain inside the channel for some more time.

Instead, if the Cardano price continues lower and breaks below the support line, it indicates the resumption of the downtrend. The pair may then plunge toward $0.15. A short-term trend change will be signaled after buyers clear the overhead hurdle at the downtrend line.