Loading story…
Researchers linked PavinLoader, a multi-stage .NET malware loader, to several intrusion chains that used ClickFix lures, fake software downloads, and malicious RenPy packages to infect victims. Across the campaigns, operators relied on trojanized and heavily obfuscated .NET DLLs, along with abuse of MSBuild through .csproj and .bat files, to execute later stages while complicating analysis and detection.
The loader retrieved command-and-control details using EtherHiding, including Binance Smart Chain RPC calls to pull infrastructure data from blockchain-hosted content, and then fetched additional payloads. In observed cases, PavinLoader delivered Amatera Stealer and at times HijackLoader, while also using anti-analysis and anti-forensics measures such as AMSI/ETW-related evasion strings, virtualization checks, locale filtering, and infrastructure-provider checks; shared artifacts and builder-like scripts led researchers to assess that it may be operated as a Loader-as-a-Service, though no commercial panel or offering was confirmed.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Malwarebytes published an analysis tying together PavinLoader activity across malicious RenPy, ClickFix, and fake software download campaigns. The report detailed the loader's multi-stage architecture, MSBuild abuse, trojanized .NET DLLs, and EtherHiding-based C2 retrieval.
By correlating shared artifacts such as a VirusTotal item reused across more than 200 files and builder-like scripts containing comments like "EDIT HERE," researchers assessed that PavinLoader may be operated as a Loader-as-a-Service. The report notes this was not confirmed as a commercial offering.
Beyond Amatera Stealer, researchers also observed PavinLoader infections delivering other payloads, including HijackLoader. This showed the loader was being used to deploy multiple malware families on compromised systems.
The analysis found PavinLoader reused in fake software download campaigns, including cases where Dropbox was used to fetch the malware. This expanded the known delivery methods beyond RenPy and ClickFix lures.
Another campaign variant used BAT files with fake build-report comments, relaunched itself through conhost.exe with the --headless option, and then executed MSBuild on the BAT file. In the analyzed sample, the loader DLL was rebuilt by concatenating and decoding four Base64-encoded variables.
Researchers observed a ClickFix infection chain delivering an MSI named Installer_57be78.msi, which contained a legitimate MSBuild executable, a .csproj file, and a trojanized DotNetZip.dll used as the loader. The package abused MSBuild's UsingTask and related mechanisms to execute the malicious .NET component.
The reporting states that in a previously analyzed malicious RenPy campaign, PavinLoader was used in the infection chain and ultimately delivered Amatera Stealer. This establishes an earlier observed use of the loader before the newly discussed ClickFix and fake-download activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcecyberowi.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026
Threat actors are distributing fake games, mods, cracks, and software installers that abuse the legitimate **Ren’Py** visual novel engine to launch a multi-stage malware chain ending in **Amatera Stealer**. Researchers said the initial **RenPy Loader** (also called **RenEngine Loader**) extracts an encrypted ZIP archive, runs a BAT file through `forfiles.exe`, and then uses **MSBuild** to execute a trojanized .NET component, advancing the infection through several downloader and anti-analysis stages. The later stages include anti-sandbox checks, removal of the Mark-of-the-Web via the `Zone.Identifier` alternate data stream, and reflective loading of a malicious **Nancy** .NET component before the stealer is decrypted and executed. The campaigns were hosted on fake download sites, **itch.io** pages, and file-sharing services, and used the **EtherHiding** technique to pull command-and-control details from blockchain data, complicating infrastructure takedowns and attribution; published indicators include malicious domains, IP addresses, and file hashes tied to the downloader, loader, and final payload.
Jul 21, 2026