The game is over: when “free” comes at too high a price. What we know about RenEngine

Summary

Security researchers disclose details about RenEngine-based malware campaigns distributing multiple stealers including Lumma and ACR Stealer since March 2025. The campaigns employ complex infection chains involving RenEngine and HijackLoader as delivery mechanisms for credential-stealing malware.

Indicators of Compromise

• malware — RenEngine
• malware — HijackLoader
• malware — Lumma stealer
• malware — ACR Stealer