[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGToLvvtQa-RlDeQqd3jdR6noC8co7v3fBxlFnn9tNDo":3},{"article":4,"iocs":29,"watch_terms":42},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"614b8010-1e71-4063-bb5e-670b82831af5","The game is over: when “free” comes at too high a price. What we know about RenEngine","the-game-is-over-when-free-comes-at-too-high-a-price-what-we-know-about-renengin","We disclose new details about campaigns involving RenEngine and HijackLoader malware. Since March 2025, attackers have been distributing the Lumma stealer in a complex chain of infections, and in February 2026, ongoing attacks using ACR Stealer became known.","Security researchers disclose details about RenEngine-based malware campaigns distributing multiple stealers including Lumma and ACR Stealer since March 2025. The campaigns employ complex infection chains involving RenEngine and HijackLoader as delivery mechanisms for credential-stealing malware.",null,"https:\u002F\u002Fsecurelist.com\u002Frenengine-campaign-with-hijackloader-lumma-and-acr-stealer\u002F118891\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F02\u002F11131733\u002Frenengine-featured-image.jpg","2026-02-11T14:00:38+00:00","2026-03-15T06:36:27.650715+00:00",8,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":10,"name":19,"slug":20},"Malware","malware",[22,24],{"category":23},{"id":17,"icon":10,"name":19,"slug":20},{"category":25},{"id":26,"icon":10,"name":27,"slug":28},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[30,33,36,39],{"type":20,"value":31,"context":32},"RenEngine","Malware distribution platform used in stealer campaigns",{"type":20,"value":34,"context":35},"HijackLoader","Loader malware used in infection chain",{"type":20,"value":37,"context":38},"Lumma stealer","Information stealer distributed since March 2025",{"type":20,"value":40,"context":41},"ACR Stealer","Credential stealer malware, ongoing attacks since February 2026",[]]