Executive Summary
Malwarebytes has identified a multi-stage loader dubbed PavinLoader being utilized across various malicious campaigns, including ClickFix attacks, fake software downloads, and malicious gaming installers. The loader is characterized by its heavy use of obfuscated .NET DLLs and the EtherHiding technique, which leverages the Binance Smart Chain blockchain to retrieve command-and-control (C2) infrastructure details, making detection and takedown more difficult.
The technical workflow involves trojanized legitimate .NET DLLs, abuse of MSBuild to execute malicious .csproj files, and extensive anti-analysis checks to avoid virtualized environments. PavinLoader has been observed delivering Amatera Stealer and HijackLoader, suggesting it may be operating as a Loader-as-a-Service (LaaS) for various cybercriminal groups.
The impact of these campaigns is significant due to the loader's ability to verify the victim's geographic location (avoiding CIS countries) and its focus on stealing sensitive information through final-stage payloads. Organizations should be particularly wary of fake CAPTCHA prompts that instruct users to execute PowerShell commands, a hallmark of ClickFix delivery methods.