Security researchers have mapped out a new wave of Windows malware attacks under the “ClickFix” umbrella, where victims are persuaded to trigger infections via fake verification pages, bundled downloads, or disguised game installers. The central piece in these attacks is PavinLoader—a flexible loader that fetches different malware families once inside. These campaigns pose a growing threat because users are often tricked through social engineering rather than technical exploits.
How PavinLoader Works in ClickFix Campaigns
The infection starts when someone lands on a page mimicking a CAPTCHA prompt, downloads what looks like legitimate software, or installs a game. In one case, the user is urged to run a command—often via Run, PowerShell, or Command Prompt—which sets the chain in motion.
Some samples of PavinLoader arrive as MSI installer packages. One such installer contained a renamed version of a valid Microsoft build tool (MSBuild), alongside a project file and a tampered DotNetZip library. The workflow abuses MSBuild to hand off malicious code hidden within legitimate Windows build components.
Other campaigns use BAT or CMD files with fake comments—like “BUILD VERIFICATION REPORT”—to distract security tools. Once launched (often via conhost.exe), these scripts reconstruct the loader from encoded data and launch MSBuild, containing the malicious payload.
Advanced Command-and-Control via Blockchain & Payload Flexibility
PavinLoader’s second stage features clever counter-surveillance: early libraries in the chain can tweak network settings, disable SSL certificate checks, and detect sandbox or analysis tools before the final payload is fetched.
One standout tactic is using EtherHiding, a technique where PavinLoader doesn’t store the command-and-control server address directly. Instead, it consults a blockchain smart contract to retrieve that address after execution. This helps obfuscate infrastructure and complicate blockage or assignment of sources.
In documented incidents involving games built with RenPy, PavinLoader ultimately brought in Amatera Stealer (version 4.2.3-alpha1), while other incidents swapped in malicious loaders like HijackLoader. The modular design means attackers can swap in varying payloads depending on the objective.
How to Detect and Prevent These Attacks
User caution is the first line of defense. Never execute commands in Run, CMD, PowerShell, or Terminal simply because a website tells you to. Download games or software only from verified publishers.
For organizations, monitoring how MSBuild is used—especially when launched from odd file locations like user profile folders—and watching for unexpected project files or scripts can spot malicious behavior. Also, tracking outbound connections to domains similar to those tied to known ClickFix infrastructure helps.
Sample hashes and IP addresses have been shared to help with detection, along with domains used for command-and-control. These indicators of compromise are essential for detecting ongoing or past infections.
This evolution in malware design—leveraging trusted Windows components, blockchain-based infrastructure, and a swapping toolbox of payloads—raises the bar for both attackers and defenders. Security teams need to adapt their alerting to not just file presence, but behavior pattern deviations. Defensive strategy should assume that social engineering and developer tools are the new weaponized frontlines. What to watch next: how effectively EtherHiding spreads, whether other infostealers piggyback off PavinLoader, and if smart contracts become more mainstream in C2 infrastructure.
