Security Not yet confirmed elsewhere 1 publisher2 min readPublished Aug 24, 2026, 6:57 PM PDT

PavinLoader: the lures keep changing, the MSBuild stage does not

Malwarebytes traces one loader through ClickFix prompts, malicious game installs and fake software downloads. The shared part is a .csproj-to-MSBuild handoff and a blockchain lookup for C2.

The Watch · Security desk

How we use AI Send a correction

What happened

Malwarebytes says the loader it tracks as PavinLoader, first seen in malicious RenPy campaigns, now appears in ClickFix attacks and fake software download campaigns.
The entry points have nothing in common: a fake CAPTCHA that tells the victim to run a command, an apparently legitimate download, or a malicious game install.
In each case Inno Setup or MSI installers built with different builders run the .bat and .csproj files that start the chain.
The loader then reads its C2 domain from a blockchain via EtherHiding and fetches later stages over paths like assets/{two random words}.json on .lat, .icu, .shop and .cfd domains.
In the RenPy chain the final payload was Amatera Stealer, and Malwarebytes says other PavinLoader infections delivered other malware.

Why it matters

constraint Controls aimed at the lure, CAPTCHA awareness, game-installer policy, download reputation, only cover the part the operators swap out between campaigns.
capability A single rule on the installer-to-script-to-MSBuild lineage reaches three clusters that look unrelated at intake, which is a much better ratio than three lure-specific blocks.
exposure The C2 address only becomes a blockable indicator after the loader has run and read it, so network blocklists are structurally late to this chain.
precedent If one build process is producing files for multiple operators, artifact overlap stops being evidence of a shared actor, and campaign-level attribution by filename or compilation trace gets weaker.

The chokepoint is a build tool. MSBuild ships with .NET, is signed by Microsoft, and reads project files that can carry executable logic; Malwarebytes reports PavinLoader using property functions such as `[System.Reflection.Assembly]::Load(...)` and `UsingTask` to load and run code out of a DLL ^[12]. The DLLs are real open-source libraries with malicious methods inserted into them, among them DotNetZip, Nancy, Renci.SshNet and OpenXML, with the added methods following a TwoWords or TwoWordsNumber pattern such as `DefaultEvaluator5` and `FallbackFactory5` ^[9]. The same two-random-word habit runs through DLL names, functions, strings and C2 paths: `GollopDevest`, `UnbrandRunover`, `PavinWide` ^[10]. It is a lazy convention, and lazy conventions are the kind of thing that survives a rebuild.

Count the stages and the priorities are visible. Malwarebytes identifies four DLLs in the cases it analysed: a Loader that does anti-forensics and anti-analysis work and adjusts network settings, an EtherHiding Loader, an Anti-Analysis DLL that hunts for virtualised environments, and a PE Loader for the final payload ^[14]. Two of those four exist only to make observation harder ^[18]. That is a direct statement about where verdicts should come from: a detonation environment is what the third stage is built to notice, while the parent-child chain from installer to script to MSBuild is what the operators have kept constant ^[3].

The Loader-as-a-Service question is unresolved and worth watching for practical reasons rather than taxonomy. Malwarebytes found one VirusTotal artifact shared by more than 200 files tied to PavinLoader, which it reads as a possible compilation artifact of the build process ^[7], plus a PowerShell script carrying comments including `EDIT HERE` and `REPLACE with a real direct link to your .bat`, and an associated BAT file containing the string `Automated builder helper` ^[8]. It also says plainly that no build panel and no sales channels were found, so commercial distribution is a possibility rather than a finding ^[19]. If a builder is doing the work, then the recurring filenames Malwarebytes lists, `prefetch_9a59.cmd`, `telemetry_55db.cmd`, `bootstrap_64be.cmd`, nine-character names like `aegZpQ4C7.bat`, and short ones like `Small.msi` ^[13], are defaults rather than fingerprints of any one operator.

Which leaves a short hunt with a long reach: an installer writing a `.cmd`, `.bat` or `.csproj` ^[15], that file spawning MSBuild, and MSBuild loading an assembly by reflection ^[12]. Intermediate payloads vary by campaign configuration ^[16], so the tail of the chain will keep moving. The middle of it has not.

What to watch

Whether a build panel or a sales channel surfaces, which would move Loader-as-a-Service from possibility to finding.
Whether the non-RenPy clusters get their final payloads named, and whether they differ from the RenPy outcome.
Whether the chain drops MSBuild for another signed interpreter once process-lineage detections on MSBuild parents become common.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence66
Adoption52
Hype gap−8
Incentives58
Confidence61

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Malwarebytes identified a multi-stage loader, which it tracks as PavinLoader, in its earlier analysis of malicious RenPy campaigns.
ReportedSupportedSource: MalwarebytesView cited source
[2]
Further threat hunting showed the same loader being used across several different campaigns, including ClickFix attacks and fake software downloads.
ReportedSupportedSource: MalwarebytesView cited source
[3]
Common elements across the campaigns are multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs, abuse of MSBuild, .csproj and .bat files to execute them, and EtherHiding to retrieve the command-and-control domain.
ReportedSupportedView cited source
[4]
The campaigns do not all start the same way: a victim might encounter a fake CAPTCHA telling them to run a command, download what appears to be legitimate software, or install a malicious game.
ReportedSupportedView cited source
[5]
Malwarebytes identified PavinLoader in several campaign clusters: malicious RenPy campaigns, several ClickFix campaigns including recent activity from operators it previously covered, and fake software campaigns that used Dropbox to download PavinLoader.
ReportedSupportedView cited source
[6]
In the RenPy campaign analysed, the process ultimately led to Amatera Stealer, malware designed to steal information from an infected computer; Malwarebytes also observed PavinLoader infections delivering additional malware.
ReportedSupportedView cited source
[7]
One specific artifact on VirusTotal is shared by more than 200 files associated with PavinLoader, which Malwarebytes suggests may be a compilation artifact of the build process.
ReportedSupportedSource: MalwarebytesView cited source
[8]
Malwarebytes found a PowerShell script on VirusTotal containing comments such as "EDIT HERE" and "REPLACE with a real direct link to your .bat"; the associated BAT file contains the string "Automated builder helper".
ReportedSupportedView cited source
[9]
The trojanized .NET DLLs include DotNetZip, Nancy, Renci.SshNet and OpenXML; in most analysed cases the inserted malicious methods follow a TwoWords or TwoWordsNumber naming pattern, such as DefaultEvaluator5 and FallbackFactory5.
ReportedSupportedView cited source
[10]
A naming convention based on two random words, such as GollopDevest, UnbrandRunover and PavinWide, is used for DLL names, functions, strings, C2 paths and other artifacts.
ReportedSupportedView cited source
[11]
PavinLoader uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to obtain the C2 domain, then makes HTTP requests using paths such as assets/{two random words}.json to retrieve subsequent stages; C2 domains commonly use the .lat, .icu, .shop and .cfd top-level domains.
ReportedSupportedView cited source
[12]
PavinLoader uses MSBuild mechanisms for loading and executing code from DLLs, including property functions such as [System.Reflection.Assembly]::Load(...) and UsingTask.
ReportedSupportedView cited source
[13]
Recurring filename patterns include name_4characters.cmd/bat/msi/exe, for example prefetch_9a59.cmd, telemetry_55db.cmd and bootstrap_64be.cmd, random nine-character names such as aegZpQ4C7.bat, and short names including Small.msi, small.bat and small.cmd.
ReportedSupportedView cited source
[14]
The stages identified are a Loader DLL that performs anti-forensics and anti-analysis operations, changes network settings and loads the EtherHiding Loader; an EtherHiding Loader DLL that obtains the C2 and downloads later stages; an Anti-Analysis DLL that performs extensive checks to detect virtualized environments; and a PE Loader DLL that loads the final PE payload.
ReportedSupportedView cited source
[15]
The campaigns use Inno Setup or MSI installers generated with different builders that run the .bat and/or .csproj files.
ReportedSupportedView cited source
[16]
Intermediate payloads can vary depending on the campaign configuration.
ReportedSupportedView cited source
[17]
At least three distinct campaign clusters, with different entry points, share the same PavinLoader middle stage.
DerivedSupported1 source— create a free account to open them
[18]
Two of the four identified PavinLoader DLL stages exist to frustrate analysis: the Loader DLL (anti-forensics and anti-analysis) and the Anti-Analysis DLL.
DerivedSupported1 source— create a free account to open them
[19]
Malwarebytes says the loader's use across multiple campaigns raises the possibility that PavinLoader is offered as a Loader-as-a-Service, but it has not found a build panel or sales channels that would confirm commercial distribution.
ReportedInsufficientSource: MalwarebytesView cited source

Sources

1 independent publisher whose own reporting we read for this story.

malwarebytes.com
1 article · August 24, 2026
Tracking PavinLoader across ClickFix and fake download campaigns

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

For builders the uncomfortable detail is what the malware borrows: trojanized copies of DotNetZip, Nancy, Renci.SshNet and OpenXML, with injected methods named in a TwoWords/TwoWordsNumber style, executed by a genuine MSBuild binary pointed at an attacker-supplied .csproj via UsingTask and [System.Reflection.Assembly]::Load(...). Nothing here suggests the upstream packages themselves are compromised — the report does not say how the trojanized copies are produced — but it does mean developer toolchain components on an endpoint are the execution engine, and that any allowlist treating MSBuild or familiar .NET assembly names as benign is doing the attacker's work.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence66: 0100
Detailed first-party technical analysis, single vendor
The report is granular and internally consistent: four named DLL stages, concrete MSBuild invocation with a real command line, specific trojanized libraries, naming and filename conventions, C2 request path shape and TLD set, plus VirusTotal corroboration of a shared build artifact. That is well above assertion level. It is capped by being one vendor's own hunting output with no independent confirmation, no hashes or domain indicators in the supplied text, and a body that is truncated mid technical analysis.
Adoption52: 0100
In-the-wild use across three clusters, unsized
Adoption here is criminal deployment, and it is real and plural: ClickFix campaigns, malicious Ren'Py game installs and Dropbox-hosted fake software all route through the same loader, with an Amatera Stealer outcome in one analysed chain and 200+ related files on VirusTotal. It stays mid-range because the report gives no victim counts, no geography, no telemetry volume and no timeline of prevalence, so scale is indicated but not measured.
Hype gap−8: −100 understated0 aligned+100 overstated
Claims slightly conservative against evidence
The framing tracks the evidence and in one place undersells it: the most marketable conclusion — a commercial Loader-as-a-Service — is raised and then explicitly withheld for lack of a build panel or sales channels, even though builder-helper strings and a shared compilation artifact across 200+ files would tempt a stronger claim. The headline promise (lures change, MSBuild stage does not) is exactly what the technical body supports. Slightly negative rather than zero because the operational significance of the cross-cluster shared stage and the EtherHiding-based C2 resilience is stated plainly and left unamplified.
Incentives58: 0100
Security vendor publishing on its own detections
Malwarebytes is a commercial endpoint-security vendor and this is first-party research that references and links its own prior blog posts, so there is a clear promotional interest in demonstrating visibility into an emerging loader and in naming it. The score is moderate rather than high because the write-up is technical rather than product-led in the supplied text, offers no product claims or detection-marketing pitch, and explicitly limits its own strongest conclusion — behaviour that runs against pure promotional incentive.
Confidence61: 0100
Technically credible, single-sourced and unsized
Confidence is moderate: the mechanics are described concretely enough to act on and the report is candid about what it cannot show, which supports the core claim that one loader stage spans several lure ecosystems. It is held down by total dependence on one vendor, absence of independent corroboration, no indicators or victim data in the supplied text, and the open question of whether the shared tooling reflects a single service, a shared builder or copied technique.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Blockchain-hosted C2 resolutionFollow
ClickFix-Style Social Engineering Follow
Crimeware-as-a-ServiceFollow
Infostealer payloadsFollow
Malware loaders and delivery chains Follow
MSBuild and LOLBin abuseFollow