PavinLoader Malware Spreads via ClickFix and Fake Download Campaigns

PavinLoader, a multi-stage downloader, appears across several distinct campaign clusters. First identified during earlier RenPy game analysis, the loader now surfaces in ClickFix attacks and fake software downloads, ultimately deploying information-stealing malware.

Despite differences in how these campaigns reach victims, Malwarebytes threat intelligence found several common threads: multi-stage infection chains built on heavily obfuscated and trojanized .NET DLLs, abuse of MSBuild, .csproj, and .bat files to execute them, and EtherHiding to retrieve the command-and-control (C2) domain.

The campaigns reach victims through different lures but converge on a consistent execution chain. A victim might encounter a fake CAPTCHA instructing them to run a command, download what looks like legitimate software, or install a malicious game .

One ClickFix cluster Malwarebytes had documented in an earlier report has recently pivoted to using PavinLoader, delivering a fake Cloudflare verification page that leads to an MSI file, bundling the legitimate MSBuild executable alongside a trojanized DotNetZip DLL executed via a .csproj file.

A separate fake-software cluster used Dropbox to distribute the loader, while another used BAT files.

PavinLoader retrieves its C2 domain through EtherHiding, a technique that hides infrastructure data on the blockchain via an ETH RPC call to bsc-dataseed.binance.org. The chain runs through four stages:

The final payload is Amatera Stealer 4.2.3-alpha1, disguised as WPA.exe (mimicking Windows Performance Analyzer).

The researchers found anti-analysis strings tied to AMSI/ETW patching, as the malware specifically targets AmsiScanString, System.Management.Automation.AmsiUtils, and EtwEventWrite – Windows' built-in antimalware scanning and event-tracing interfaces.

The report said more than 100 URLs belonging to legitimate services are also “ decrypted and used to generate HTTP requests and network noise .”

In some infections, Malwarebytes also observed WiX Burn bundles delivering additional PavinLoader payloads, or HijackLoader instead.

The anti-analysis DLL checks the system's keyboard layout against more than 17 languages, including Russian, Ukrainian, Belarusian, and Armenian, then separately geolocates the machine's IP address and blocks execution if the region code matches CIS-adjacent countries.

It also checks for virtualized environments using firmware tables and PCI vendor IDs associated with VMware, VirtualBox, QEMU, Xen, Parallels, and cloud providers, including Amazon and Google.

A VirusTotal artifact shared by more than 200 files, plus a PowerShell script containing "EDIT HERE" and "REPLACE with a real direct link to your .bat" and a BAT file referencing an "Automated builder helper," raises the possibility that PavinLoader is offered as a Loader-as-a-Service. Yet, Malwarebytes says it has not found a build panel or sales channel to confirm this commercially.

Full technical indicators of compromise are published directly, including:

In June, XLab observed a Ghost CMS SQL injection vulnerability that facilitates large-scale ClickFix campaigns .