ClickFix Campaigns Use PavinLoader with Blockchain C2 to Deploy Amatera Stealer

Key Takeaways

• “ClickFix” campaigns are actively exploiting user interaction to deliver sophisticated malware.
• The primary payload delivery mechanism is “PavinLoader,” distributed via fake CAPTCHA pages, deceptive software downloads, and malicious game installers.
• PavinLoader utilizes blockchain technology for its command-and-control (C2) infrastructure, making detection and disruption more challenging.
• The ultimate payload often includes “Amatera Stealer 4.2.3-alpha1,” designed to exfiltrate sensitive data such as passwords, browser information, and cryptocurrency wallet details.
• These campaigns heavily rely on social engineering and the abuse of legitimate Windows utilities like MSBuild to execute malicious code.

ClickFix Campaigns Leverage Social Engineering and PavinLoader

Recent “ClickFix” campaigns are transforming seemingly innocuous web interactions into full-blown Windows infections. Threat actors are employing a loader known as PavinLoader, which infiltrates systems through various deceptive tactics, including fake verification pages, fraudulent software downloads, and malicious game installers. Once established, PavinLoader proceeds to download additional malware payloads.

These sophisticated attacks are notable for integrating the victim directly into the execution chain. For instance, a deceptive CAPTCHA prompt might instruct a user to copy and execute a command, while a malicious installer can initiate the same process covertly. The malware then leverages trusted Windows components to navigate through its hidden stages, making detection difficult for unsuspecting users.

Malwarebytes researchers have meticulously tracked PavinLoader’s deployment across multiple “ClickFix” clusters, malicious RenPy game campaigns, and fake software download schemes. Their investigations revealed instances where Dropbox was utilized to host the loader, demonstrating the attackers’ agility in changing their initial lures without altering the core infection chain.

The consequences for victims are severe, encompassing the theft of critical personal data. This includes passwords, browser data, cryptocurrency-wallet information, and other sensitive files.

In one specific RenPy case, PavinLoader was observed delivering Amatera Stealer. Other successful infections have introduced various payloads, including HijackLoader. This adaptability highlights how a successful “ClickFix” infection can serve diverse operational goals for the attackers.

Initial Infection Vector: Social Engineering, Not Exploits

The initial phase of these attacks hinges on social engineering rather than exploiting software vulnerabilities. Victims are typically lured to pages mimicking legitimate CAPTCHA challenges, enticed to download what appears to be legitimate software, or tricked into installing a malicious game.

In “ClickFix” scenarios, the malicious page actively persuades users to execute a command. This approach, documented in recent ClickFix delivery methods, relies entirely on user action rather than a technical exploit to gain initial access.

One observed “ClickFix” chain involved the download of an MSI package named Installer_57be78.msi. Analysis of its contents revealed a renamed, legitimate MSBuild executable, a project file, and a trojanized DotNetZip.dll. The project file then leveraged MSBuild to load the manipulated library, effectively camouflaging malicious activities within a component commonly used for software development.

Other samples employed BAT or CMD files containing seemingly innocuous comments, such as fake “BUILD VERIFICATION REPORT” text, to evade scrutiny. These scripts then relaunch through conhost.exe, locate MSBuild, and reconstruct a loader from encoded data. This abuse underscores the importance for defenders to monitor how trusted Windows build utilities are invoked, rather than merely confirming their presence.

The consistent use of PavinLoader across various lure types suggests it might be offered as a service, though researchers were unable to confirm a public sales operation. Related files shared a common VirusTotal artifact, and a PowerShell script contained comments indicative of builder-style code. While these clues point to a repeatable deployment model, they do not definitively identify the supplier of the loader.

Blockchain C2 Facilitates Amatera Stealer Delivery

Upon successful execution, PavinLoader employs several .NET library stages designed to impede analysis and prepare for the subsequent payload download. The initial malicious library is capable of modifying network settings, disabling certificate validation, detecting analysis tools, and then loading a second component. This modular design allows threat actors to swap out final payloads without significantly altering the early stages of the infection chain.

The second component uses a technique called EtherHiding to identify its command-and-control (C2) server. Instead of embedding the C2 address directly within the malware, it initiates a blockchain request and retrieves the C2 address from a smart-contract response. This method significantly complicates efforts to block and investigate the malicious infrastructure, as the attacker effectively separates the visible loader from the actual server address.

Before delivering the final payload, an anti-analysis module conducts checks for virtual machines, hosted infrastructure, and specific language or regional settings. It also utilizes public IP lookup services during this screening process. If the infected device passes these stringent checks, the loader proceeds to download a PE loader and the ultimate executable via JSON paths.

In the documented RenPy infection chain, the final file masqueraded as WPA.exe, the name of Windows Performance Analyzer, but was in fact an obfuscated sample of Amatera Stealer 4.2.3-alpha1. Individuals monitoring Amatera Stealer delivery chains should note that its deployment here highlights a loader design capable of introducing various malware types following the initial compromise.

What You Should Do

• Exercise Extreme Caution with Web Prompts: Never follow instructions from a website to open “Run,” “Command Prompt,” “Terminal,” or “PowerShell” and paste a command. Legitimate websites do not require this.
• Verify Software and Game Sources: Download software and games exclusively from official, trusted publishers and reputable app stores. Avoid third-party download sites, torrents, or suspicious links.
• Monitor for Unusual Activity: Organizations should actively monitor for unusual launches of legitimate Windows utilities like MSBuild, unexpected project or script files appearing in user profile folders, and suspicious outbound network requests to unfamiliar infrastructure.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to anomalous process behavior and file modifications, even when legitimate tools are being abused.
• Educate Users on Social Engineering: Conduct regular cybersecurity awareness training for all staff, emphasizing the dangers of phishing, deceptive web pages, and the importance of verifying download sources.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.