Fake Game Downloads Push Amatera Password Stealer

How the attack worked

This campaign relies on fake downloads of games, mods, cracks, and software to get victims to run malware. The lure is delivered through fake download websites, itch.io pages, and common file-sharing services such as Wormhole, GoFile, Google Drive, and MEGA. Once a victim downloads the archive, it contains a file named Setup.exe. Opening that file starts a multi-stage infection chain. The victim typically sees what looks like a normal installer or loading screen while malicious code runs silently in the background, eventually deploying Amatera Stealer to collect passwords, wallet data, browser data, and other sensitive information.

In several observed cases, clicking a download link redirected the user through another fake download website before the final file was served, adding extra layers meant to obscure the true source of the malware. The infection chain also used techniques such as MSBuild abuse and EtherHiding, a method of retrieving command-and-control details from a public blockchain, to help the malware evade detection.

Why it succeeded

The attack works because it exploits normal user behavior around downloading free or unofficial software. People searching for game mods, cracks, or free versions of paid software are often willing to bypass official sources, and a convincing installer screen reinforces the illusion that the download is legitimate. The use of well-known, generally trusted file-sharing platforms for hosting the malicious files adds a false sense of safety, since the platform itself is not inherently suspicious, even though the file it hosts is malicious.

What to watch for

• Downloads that arrive from unfamiliar or unofficial sites, particularly for cracked software, mods, or free versions of paid games
• Archives that contain an executable installer, such as Setup.exe, instead of the expected game or software files
• Download links that redirect through multiple unfamiliar websites or file-sharing services before reaching the final file
• Installer or loading screens that appear normal but follow an unusual or roundabout download path

How to build resistance

Employees and personal device users should be encouraged to download games and software only from official websites, trusted app stores, or established distribution platforms, and to treat cracked software, unofficial mods, and free versions of paid games with caution. Redirect-heavy download flows should be treated as a stopping point rather than something to click through. Before running any installer, it helps to check the contents of a downloaded archive for unexpected executables like Setup.exe. Finally, it is worth reinforcing that neither a professional-looking installer nor a familiar file-sharing service guarantees that a download is safe, since both appearances can be used to mask a malicious payload running in the background.

How does the fake game download attack work?

A user downloads what looks like a game, mod, crack, or software installer, often from a fake download site, itch.io page, or file-sharing service. Opening the archive runs a file named Setup.exe, which starts a multi-stage infection that eventually deploys Amatera Stealer while the victim sees a normal-looking installer screen.

What does Amatera Stealer steal?

According to the findings, Amatera Stealer is used to steal passwords, wallet data, browser data, and other sensitive information after the infection chain completes.

What are red flags that a game download is malicious?

Warning signs include downloads from unofficial or unfamiliar sites, an archive that contains an unexpected executable like Setup.exe, and multiple redirects through different websites or file-sharing services before the file appears.

Are trusted file-sharing services like Google Drive or MEGA safe for downloads?

A familiar hosting service does not guarantee safety. The malicious files were distributed through services such as Wormhole, GoFile, Google Drive, and MEGA, so the source and legitimacy of the file itself still matter.