RenEngine Loader and HijackLoader: Dual-Stage Attack Chain Fueling Stealer Campaigns

A sophisticated, large-scale malware campaign is covertly infecting hundreds of thousands of global victims by disguising a dual-stage, modular attack chain—featuring the novel RenEngine Loader and an advanced HijackLoader variant—inside cracked game installers, enabling persistent credential theft while evading detection through creative abuse of legitimate gaming frameworks and extensive anti-analysis techniques.