Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader . Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer . Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device.