Malwarebytes' Threat Intelligence team tracked a new loader family, PavinLoader, across three distinct delivery clusters: ClickFix fake-CAPTCHA/verification pages, trojanized software downloads hosted on file-sharing services such as Dropbox, and malicious RenPy-based game installers. All three converge on the same technical infection chain, indicating a shared loader (and possibly a shared Loader-as-a-Service operator) behind otherwise unrelated lure campaigns.

The ClickFix cluster begins with a fake CAPTCHA or verification page (observed lure domain perfectverified.com) that instructs the victim to open the Windows Run dialog and paste a PowerShell one-liner (User Execution: Malicious Copy and Paste, T1204.004) — the technique MITRE ATT&CK formalized in March 2025 specifically to track this now-widespread lure pattern. The pasted command downloads an MSI installer (observed as Installer_57be78.msi) containing a renamed MSBuild.exe, a malicious .csproj project file (e.g. prefetch_2f76.csproj), and a trojanized DotNetZip.dll. The project is executed with "MSBuild.exe" /nologo "prefetch_2f76.csproj" /nr:false, with the environment variable MSBUILDENABLEALLPROPERTYFUNCTIONS=1 set so that MSBuild property functions (e.g. [System.Reflection.Assembly]::Load(...)) can execute arbitrary .NET code in-memory via UsingTask elements — a textbook Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) LOLBin abuse chain. Batch stages are relaunched through conhost.exe --headless cmd.exe /c "updater_8219.cmd" to blend in with normal console activity.

The trojanized DotNetZip.dll (methods renamed to plausible-looking names such as DefaultEvaluator5 / FallbackFactory5) acts as PavinLoader's Stage 1: it disables TLS certificate validation, alters proxy/network settings, decrypts embedded strings with multi-key XOR, and resolves API calls dynamically via GetDelegateForFunctionPointer to evade static and import-table-based detection. Stage 2 (internally named GollopDevest in observed samples) performs the loader's signature technique: EtherHiding. Rather than embedding a C2 domain directly, it issues a JSON-RPC eth_call against a smart contract (0x328a1fadff154290f0ce1389a4e633698cdfdaa7) on BNB Smart Chain via the public bsc-dataseed.binance.org RPC endpoint; the contract's response encodes the live C2 domain. Because the dead-drop lives on an immutable, censorship-resistant public ledger, the technique survives conventional domain/IP takedown response far better than a hardcoded C2. The loader then retrieves further payloads over HMAC-authenticated HTTP requests (headers X-Timestamp / X-Nonce / X-Signature) from paths like /assets/{TwoRandomWords}.json, with payload bodies XOR-encoded inside a {"cache":{"content":...}} JSON wrapper.

Stage 3 (PavinWride in observed samples) is a dedicated anti-analysis module: it enumerates system firmware tables (GetSystemFirmwareTable / EnumSystemFirmwareTables), times execution to detect debuggers/sandboxes, and checks the system UI/keyboard language against a list of 17+ CIS-associated languages (Russian, Ukrainian, Belarusian, Armenian, and others) to abort execution on likely-CIS hosts — a common criminal self-preservation control. It also probes IP geolocation/reputation services to detect hosting-provider (sandbox) infrastructure. Stage 4 is a custom PE loader (also observed as GollopDevest) that validates and reflectively maps the final payload image without writing it to disk.

Observed final payloads include Amatera Stealer 4.2.3-alpha1, masquerading on disk as WPA.exe (Windows Performance Analyzer). Amatera is a C++ information stealer that is itself a rebrand of ACR (AcridRain) Stealer, whose source was sold on underground forums by threat actor SheldIO in 2024; Proofpoint documented the rebrand along with materially improved evasion (control-flow flattening, opaque predicates, the Heaven's Gate 32/64-bit transition technique to bypass usermode hooks, and raw-socket network I/O via \Device\Afd\Endpoint alongside DNS-over-HTTPS resolution through Google's public DoH resolver). Amatera targets saved credentials, cookies, and autofill data from Chromium- and Gecko-based browsers, Discord and Thunderbird data, desktop cryptocurrency wallets, and files matching extensions such as .pdf/.docx/.xls/.jpg, plus screenshots. In November 2025, eSentire's Threat Response Unit documented an unrelated but technique-identical cluster ("EVALUSION") using ClickFix to deliver Amatera Stealer alongside NetSupport RAT, confirming ClickFix-to-Amatera is now an established, recurring pairing rather than a one-off.

Alternatively, PavinLoader chains have been observed delivering HijackLoader (aka IDAT Loader / GHOSTPULSE / SHADOWLADDER), a modular loader active since mid-2023 known for DLL search-order hijacking, process-injection-based payload delivery, call-stack spoofing, and scheduled-task persistence, sometimes packaged for delivery via WiX Burn installer bundles alongside or instead of Amatera.

Malwarebytes separately profiled the RenPy-based game-installer delivery cluster in a companion report; in the analyzed case, a trojanized RenPy game installer led through the identical MSBuild/EtherHiding chain to an Amatera Stealer payload, confirming the loader (not just the lure) is shared infrastructure across ClickFix, fake-software, and fake-game campaigns. Researchers found comments in the PowerShell staging scripts (e.g. "EDIT HERE", "REPLACE with a real direct link") consistent with a semi-templated builder, raising the possibility PavinLoader is offered as a Loader-as-a-Service, though no confirmed sales panel or attribution to a specific threat actor or group has been established.