PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2

Gbhackers •Mayura Kathir • August 25, 2026

PavinLoader, a multi-stage .NET malware loader, operating across ClickFix, fake software-download, and malicious game campaigns. The activity shows how attackers are moving beyond a single delivery vector. A victim may be lured to a fake Cloudflare or Google verification page and instructed to paste a command, persuaded to install apparently legitimate software, or tricked into […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PavinLoader Malware Exploits ClickFix and Fake Downloads to Deploy Amatera Stealer PavinLoader, a multi-stage .NET malware loader, is being utilized in ClickFix and fake software download campaigns to deploy the Amatera Stealer. Victims are lured through deceptive pages, such as fake Cloudflare verification, and instructed to execute commands or download malicious software. Malwarebytes identified various campaign clusters using heavily obfuscated .NET DLLs and techniques like EtherHiding for command-and-control communication. The malware's final payload masquerades as WPA.exe, while anti-analysis measures target Windows' built-in scanning interfaces. The loader's distribution methods include using Dropbox and BAT files, and it checks for specific geolocations and virtual environments to evade detection. Researchers suggest the possibility of PavinLoader being offered as a Loader-as-a-Service, although no sales channels have been confirmed. Full technical indicators of compromise have been published for security professionals. 2 sources 65

Extracted Entities

PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2

The full story

Extracted Entities

Attack Types (1)

Malware (3)

MITRE ATT&CK (1)