It is common for some to seek out free, pirated versions of popular games instead of purchasing them legitimately. Recently, it was revealed that a malware campaign using pirated games as bait has infected 400,000 systems worldwide, potentially compromising sensitive personal information, including financial data.

This discovery was announced on the 4th (local time) by Howler Cell, a research team under the American PC security firm Cyderes, via their official website. According to the investigation, the campaign has been active since April of last year, utilizing pirated versions of Far Cry, EA Sports FC, Need for Speed, and Assassin's Creed as bait to attract victims.

When users download files from websites distributing these pirated versions, the first stage of infection, 'RenEngine Loader,' is executed. This loader exploits the legitimate Ren'Py game engine to inject Python-based malicious scripts into the game archives.

Ultimately, the 'ACR Stealer' malware is installed on the infected PC to exfiltrate information. This malware targets saved usernames and passwords, browser cookies, autofill data, credit card information, cryptocurrency wallet files, and messenger sessions. This poses a significant risk of a chain reaction of hacks, affecting not only game accounts but also email, social media, and banking services.

Cyderes researchers stated that the attack began in April of last year and has resulted in over 400,000 victims globally. They added that more than 5,000 new victims are being identified every day. The top 10 countries affected by the malware are India, the US, Brazil, Russia, Egypt, Turkey, Spain, Indonesia, Pakistan, and France.

Furthermore, the research team noted that the malware is distributed not only through pirated games but also through user-made mods. The team explained, 'These distribution methods rely on trust within piracy communities rather than exploiting technical vulnerabilities. This is highly effective against users with poor security awareness or weak endpoint security settings.' The analysis suggests that attackers exploit the habit of users who trust sites they frequent, often leading them to temporarily disable antivirus software or ignore security warnings to run the game.