# ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer

> ClickFix fake-verification lures, trojanized software downloads, and malicious RenPy game installers are delivering a newly documented multi-stage .NET loader, PavinLoader, which abuses MSBuild to run trojanized libraries, resolves its C2 domain via an EtherHiding blockchain smart contract on BNB Smart Chain, and drops Amatera Stealer 4.2.3-alpha1 or HijackLoader to steal browser data, credentials, and cryptocurrency-wallet information.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-08-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2142
- **ID:** TL-2026-2142
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes' Threat Intelligence team tracked a new loader family, PavinLoader, across three distinct delivery clusters: ClickFix fake-CAPTCHA/verification pages, trojanized software downloads hosted on file-sharing services such as Dropbox, and malicious RenPy-based game installers. All three converge on the same technical infection chain, indicating a shared loader (and possibly a shared Loader-as-a-Service operator) behind otherwise unrelated lure campaigns.

The ClickFix cluster begins with a fake CAPTCHA or verification page (observed lure domain perfectverified.com) that instructs the victim to open the Windows Run dialog and paste a PowerShell one-liner (User Execution: Malicious Copy and Paste, T1204.004) — the technique MITRE ATT&CK formalized in March 2025 specifically to track this now-widespread lure pattern. The pasted command downloads an MSI installer (observed as Installer_57be78.msi) containing a renamed MSBuild.exe, a malicious .csproj project file (e.g. prefetch_2f76.csproj), and a trojanized DotNetZip.dll. The project is executed with "MSBuild.exe" /nologo "prefetch_2f76.csproj" /nr:false, with the environment variable MSBUILDENABLEALLPROPERTYFUNCTIONS=1 set so that MSBuild property functions (e.g. [System.Reflection.Assembly]::Load(...)) can execute arbitrary .NET code in-memory via UsingTask elements — a textbook Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) LOLBin abuse chain. Batch stages are relaunched through conhost.exe --headless cmd.exe /c "updater_8219.cmd" to blend in with normal console activity.

The trojanized DotNetZip.dll (methods renamed to plausible-looking names such as DefaultEvaluator5 / FallbackFactory5) acts as PavinLoader's Stage 1: it disables TLS certificate validation, alters proxy/network settings, decrypts embedded strings with multi-key XOR, and resolves API calls dynamically via GetDelegateForFunctionPointer to evade static and import-table-based detection. Stage 2 (internally named GollopDevest in observed samples) performs the loader's signature technique: EtherHiding. Rather than embedding a C2 domain directly, it issues a JSON-RPC eth_call against a smart contract (0x328a1fadff154290f0ce1389a4e633698cdfdaa7) on BNB Smart Chain via the public bsc-dataseed.binance.org RPC endpoint; the contract's response encodes the live C2 domain. Because the dead-drop lives on an immutable, censorship-resistant public ledger, the technique survives conventional domain/IP takedown response far better than a hardcoded C2. The loader then retrieves further payloads over HMAC-authenticated HTTP requests (headers X-Timestamp / X-Nonce / X-Signature) from paths like /assets/{TwoRandomWords}.json, with payload bodies XOR-encoded inside a {"cache":{"content":...}} JSON wrapper.

Stage 3 (PavinWride in observed samples) is a dedicated anti-analysis module: it enumerates system firmware tables (GetSystemFirmwareTable / EnumSystemFirmwareTables), times execution to detect debuggers/sandboxes, and checks the system UI/keyboard language against a list of 17+ CIS-associated languages (Russian, Ukrainian, Belarusian, Armenian, and others) to abort execution on likely-CIS hosts — a common criminal self-preservation control. It also probes IP geolocation/reputation services to detect hosting-provider (sandbox) infrastructure. Stage 4 is a custom PE loader (also observed as GollopDevest) that validates and reflectively maps the final payload image without writing it to disk.

Observed final payloads include Amatera Stealer 4.2.3-alpha1, masquerading on disk as WPA.exe (Windows Performance Analyzer). Amatera is a C++ information stealer that is itself a rebrand of ACR (AcridRain) Stealer, whose source was sold on underground forums by threat actor SheldIO in 2024; Proofpoint documented the rebrand along with materially improved evasion (control-flow flattening, opaque predicates, the Heaven's Gate 32/64-bit transition technique to bypass usermode hooks, and raw-socket network I/O via \Device\Afd\Endpoint alongside DNS-over-HTTPS resolution through Google's public DoH resolver). Amatera targets saved credentials, cookies, and autofill data from Chromium- and Gecko-based browsers, Discord and Thunderbird data, desktop cryptocurrency wallets, and files matching extensions such as .pdf/.docx/.xls/.jpg, plus screenshots. In November 2025, eSentire's Threat Response Unit documented an unrelated but technique-identical cluster ("EVALUSION") using ClickFix to deliver Amatera Stealer alongside NetSupport RAT, confirming ClickFix-to-Amatera is now an established, recurring pairing rather than a one-off.

Alternatively, PavinLoader chains have been observed delivering HijackLoader (aka IDAT Loader / GHOSTPULSE / SHADOWLADDER), a modular loader active since mid-2023 known for DLL search-order hijacking, process-injection-based payload delivery, call-stack spoofing, and scheduled-task persistence, sometimes packaged for delivery via WiX Burn installer bundles alongside or instead of Amatera.

Malwarebytes separately profiled the RenPy-based game-installer delivery cluster in a companion report; in the analyzed case, a trojanized RenPy game installer led through the identical MSBuild/EtherHiding chain to an Amatera Stealer payload, confirming the loader (not just the lure) is shared infrastructure across ClickFix, fake-software, and fake-game campaigns. Researchers found comments in the PowerShell staging scripts (e.g. "EDIT HERE", "REPLACE with a real direct link") consistent with a semi-templated builder, raising the possibility PavinLoader is offered as a Loader-as-a-Service, though no confirmed sales panel or attribution to a specific threat actor or group has been established.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1127.001 MSBuild
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1497.001 System Checks
- T1614.001 System Language Discovery
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1071.004 DNS
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System

## Sources

- [Tracking PavinLoader across ClickFix and fake download campaigns](https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns)
- [ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer](https://cybersecuritynews.com/clickfix-campaigns-pavinloader/)
- [Tracking PavinLoader across ClickFix and fake download campaigns (syndication)](https://securityboulevard.com/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns/)
- [PavinLoader Abuses MSBuild and Trojanized .NET DLLs in Multi-Stage Malware Attacks](https://cyberpress.org/pavinloader-abuses-msbuild-dlls/)
- [New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware)
- [Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet](https://www.trendmicro.com/en_gb/research/26/e/smart-contracts-for-command-and-control.html)
- [Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication](https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication)
- [EVALUSION Campaign Delivers Amatera Stealer and NetSupport RAT](https://www.esentire.com/blog/evalusion-campaign-delivers-amatera-stealer-and-netsupport-rat)
- [HijackLoader Expands Techniques to Improve Defense Evasion](https://www.crowdstrike.com/en-us/blog/hijackloader-expands-techniques/)
- [Amatera (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.amatera)
- [HijackLoader (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.hijackloader)
- [User Execution: Malicious Copy and Paste, T1204.004](https://attack.mitre.org/techniques/T1204/004/)
- [Trusted Developer Utilities Proxy Execution: MSBuild, T1127.001](https://attack.mitre.org/techniques/T1127/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2142