Malwarebytes has been following a loader it calls PavinLoader since it surfaced inside fake RenPy game installers earlier this year. In research published on 24 August, the company says the same loader now sits behind several unrelated-looking scams: ClickFix pages that talk victims into pasting a command, fake software download sites, and malicious installers pulled from Dropbox.
The way victims arrive changes. What happens after they click barely does.
The same machinery under every lure
Across the campaigns Malwarebytes analysed, the chain uses Inno Setup or MSI installers that drop a batch or .csproj file and hand it to MSBuild, a legitimate Microsoft build tool that ships with Windows, so the process actually running the code is signed and unremarkable. The payload lives inside trojanized copies of well known .NET libraries, including DotNetZip, Nancy, Renci.SshNet and OpenXML, with the malicious method dropped in under a bland two word name such as DefaultEvaluator5.
Filenames follow recognisable patterns, the researchers note: prefetch_9a59.cmd, telemetry_55db.cmd, bootstrap_64be.cmd, or nine random characters. Component names are built from two random English words, which is where GollopDevest, UnbrandRunover and PavinWide come from.
The server address lives on a blockchain
Rather than hard code a command and control domain, PavinLoader uses EtherHiding: it makes a JSON-RPC call to a Binance Smart Chain node at bsc-dataseed[.]binance[.]org and reads the answer out of a smart contract. That returns the current C2 domain, from which later stages are fetched over paths like /assets/ExponeAboard.json. The domains Malwarebytes observed favour .lat, .icu, .shop and .cfd. We covered the same technique in the RenPy game campaign that first exposed this loader.
It decides whether you are worth infecting
One stage does nothing but inspect the environment. It reads the keyboard layout list and compares it against more than 17 languages including Russian, Ukrainian, Belarusian and Armenian, walks the registry and firmware tables for VMware, VirtualBox, QEMU, Xen, Hyper-V and Parallels signatures, and calls public geolocation services such as hxxps://ipinfo[.]io/json to check the country code against RU, UA, BY, AM, KZ, KG, TJ, UZ, GE, AZ and MD. Only when those checks pass do the final stages download.
The payload Malwarebytes recovered was Amatera Stealer 4.2.3-alpha1, disguised as WPA.exe. In other runs the researchers saw HijackLoader instead, so a compromised machine can end up carrying more than one family.
Sold to more than one crew?
Malwarebytes stops short of calling PavinLoader a commercial service, and says so plainly. More than 200 files on VirusTotal share a single artifact that looks like a build process fingerprint, and an uploaded PowerShell script carries comments reading EDIT HERE and REPLACE with a real direct link to your .bat, alongside a batch file containing the string Automated builder helper. No build panel or sales channel has been found. The team describes loader as a service as a possibility its evidence supports but does not confirm.
Watch for MSBuild running out of AppData
There is no patch here, because this is malware rather than a product flaw. The useful detection is behavioural: MSBuild.exe or conhost.exe launching from a user profile directory, MSBuild invoked with a .cmd or .csproj file as its input, and the MSBUILDENABLEALLPROPERTYFUNCTIONS environment variable being set. Outbound traffic from an ordinary workstation to a Binance Smart Chain RPC endpoint is another signal worth alerting on.
Selected defanged indicators: 93[.]152[.]224[.]75, 65[.]21[.]80[.]170 and 195[.]63[.]142[.]49 served loader stages, and sample hashes include bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c and e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9. The full set is in the original report.
ClickFix has spent 2026 becoming the default way to get a first stage onto a machine, from fake developer documentation to bogus CAPTCHA prompts. What this research adds is the layer underneath: one obfuscated, blockchain addressed loader quietly serving several front ends at once.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.