PavinLoader in ClickFix campaigns

Summary

Malwarebytes published this on 24 August 2026, following a multi-stage loader it calls PavinLoader from the RenPy fake-game campaigns it had analysed earlier into other operations: ClickFix pages, including a Cloudflare-themed one whose PowerShell fetches an installer from a cloud storage bucket, and fake software downloads served from Dropbox. The routes then converge. Legitimate MSBuild runs project or batch files that load trojanised copies of real .NET libraries, the loader reads its C2 domain from a BNB Smart Chain contract, and later stages arrive as XOR-encoded JSON. It checks for virtual machines and compares the keyboard languages and region against Russian and neighbouring locales. In the chain Malwarebytes followed, the payload was Amatera Stealer. Builder artefacts hint, unconfirmed, that it is sold as a service. The indicator list covers the loader across all these campaigns, not the ClickFix route alone.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 19 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

28 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.