Cybersecurity specialists have identified a long-running malware campaign that disguises itself as installers for pirated games, utilizing a malicious component called the RenEngine Loader. This loader operates stealthily, embedding itself within the system while allowing the game to run without disruption, thus evading detection. The campaign has been active since at least April 2025 and primarily targets popular titles from Electronic Arts and Ubisoft, such as Far Cry, FIFA, Need for Speed, and Assassin’s Creed. The malicious code appears as a harmless launcher based on Ren’Py, leading users to believe the installation is normal. Once installed, the loader can facilitate further exploits without immediate data exfiltration. Telemetry has recorded over 400,000 inquiries related to this distribution chain, with an average detection rate of around 5,000 incidents per day, and Russia ranks fourth in these observations.