PavinLoader Spreads Through ClickFix and Fake Downloads

Malwarebytes researchers have identified PavinLoader in several Windows infection campaigns that begin with different lures: fake CAPTCHA instructions, counterfeit software downloads, and malicious Ren’Py game installers. Seeing one of those pages is not itself an infection. The serious exposure starts when a user runs the copied command, installer, or game package, allowing a multi-stage chain to abuse MSBuild, load trojanized .NET components, find its server through EtherHiding, and deliver Amatera Stealer or another payload.

The name matters because PavinLoader is no longer tied to one fake-game campaign. The same technical pattern now connects several delivery routes. Malwarebytes says the shared artifacts suggest the loader could be offered as a service, but the researchers did not find a sales channel or build panel and therefore do not confirm a Loader-as-a-Service operation.

How users encounter PavinLoader

• Fake CAPTCHA or ClickFix page: the page tells the visitor to copy and run a Windows command. The checkbox or page view is not the compromise boundary; executing the command is.
• Fake software download: the user receives an MSI or another installer that appears to belong to a legitimate program. Downloading it creates a file risk, while running it starts the observed chain.
• Malicious game or Ren’Py package: a game can appear to open normally while its bundled loader runs in the background. Our RenPy Loader recovery guide covers this specific branch in more detail.

Those entry points should not be treated as one universal sample. Filenames, folders, intermediate files, and final malware can change between builds. PavinLoader is the common loader pattern, not proof that every victim received the same Amatera payload.

What happens after execution

1. The lure launches an MSI, BAT/CMD file, MSBuild project, or another first-stage component.
2. A legitimate Windows build tool is used to load code from a trojanized or custom .NET DLL. Observed DLL bases included DotNetZip, Nancy, Renci.SshNet, and OpenXML.
3. An EtherHiding stage queries a blockchain contract to recover the current command-server domain instead of storing one fixed address in the first file.
4. The loader performs anti-analysis checks and retrieves later stages from that server.
5. A PE loader starts the final payload. Malwarebytes recovered Amatera Stealer in the analyzed Ren’Py chain and observed other malware in additional infections.

EtherHiding does not put the malware itself “on the blockchain.” It gives the chain a replaceable pointer to attacker infrastructure. That distinction is useful during triage: blocking one domain may interrupt a current build, but it does not remove the files that already ran or prevent the contract from pointing later builds elsewhere.

PavinLoader clues worth checking

No single filename proves a PavinLoader infection. The stronger signal is a relationship between the lure, an unusual execution path, Windows build tooling, and the following network activity. Malwarebytes documented several recurring patterns:

• .bat, .cmd, .csproj, MSI, and EXE files with short or generated-looking names;
• a copied or renamed MSBuild executable launched from a user-writable folder rather than its normal Windows framework path;
• trojanized .NET libraries with inserted methods that often follow a two-word or two-word-plus-number naming pattern;
• HTTP requests for JSON paths built from two random words, after a blockchain RPC request resolves the current server;
• later infrastructure using rotating domains, commonly under .lat, .icu, .shop, or .cfd.

These are investigation leads, not safe-delete rules. Legitimate software also uses MSBuild, DLLs, MSI packages, and some of those top-level domains. Check the parent process, original download, full path, creation time, signature, and network sequence together. If MSBuild.exe itself looks suspicious, use the MSBuild safety checklist before removing a legitimate Windows component.

What to do after a PavinLoader lure

1. If you only saw the page, close it. Do not paste its command, download its proposed “fix,” or approve an installer. A normal CAPTCHA never needs Windows Run, PowerShell, Terminal, or Command Prompt.
2. If you downloaded but did not run the file, keep it closed. Record the source URL and filename, delete or quarantine the download, and scan it without executing it.
3. If you ran the command or installer, disconnect the PC. Turn off Wi-Fi or unplug Ethernet. Do not sign in to email, banking, crypto, gaming, or work services from the suspect computer.
4. Preserve the useful trail. Save the approximate execution time, download URL, filename, browser history entry, security alerts, and any command visible in the page. Do not run the sample again.
5. Run a complete malware scan. Check the user profile, temporary folders, startup entries, scheduled tasks, services, security exclusions, browser data, and recently created .NET or MSBuild project files. Additional payloads may outlive the visible installer.
6. Recover accounts from a clean device. Start with email and the password manager, then revoke browser sessions and rotate passwords, recovery codes, crypto-wallet access, and work credentials that were available on the PC. The broader password-stealer response guide explains the order.

Deleting the original MSI, BAT file, or game folder is not enough after execution. The first-stage lure can be gone while a downloaded loader or stealer remains. Run a full Gridinsoft Anti-Malware scan, remove confirmed detections, reboot, and scan again if suspicious processes, alerts, or outbound connections return.

If the infection began with a copied command, compare the event with our ClickFix execution and account-recovery checklist. That page covers the same critical boundary: viewing a lure is different from running the command it supplies.

References

1. Gabriele Orini. “Tracking PavinLoader across ClickFix and fake download campaigns.” Malwarebytes Threat Intel, August 24, 2026. Primary technical analysis.