Reported by 2 outlets
PavinLoader Multi-Stage Malware Abuses MSBuild and Trojanized .NET DLLs
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
PavinLoader Abuses MSBuild and Trojanized .NET DLLs in Multi-Stage Malware Attacks
cyberpress.org · 49d ago · August 25th, 2026
Cybersecurity researchers have uncovered wider use of PavinLoader, a multi-stage malware loader linked to ClickFix lures, fake software installers, and malicious RenPy game campaigns. The loader combines legitimate Windows tools, trojanized .NET libraries, heavily obfuscated code, and blockchain-based infrastructure hiding to deliver final payloads. PavinLoader was previously observed in attacks distributing Amatera Stealer, an information-stealing malware family. Researchers have now found the same loader framework in several unrelated campaign clusters, suggesting that it may be offered to other criminals as a Loader-as-a-Service, although no public sales panel or marketplace has been identified. Victims may initially encounter a fake CAPTCHA page, a bogus Cloudflare or Google verification prompt, a pirated software download, or a malicious game installer. These lures use social engineering to persuade users to execute commands or install files that appear legitimate. PavinLoader Abuses MSBuild DLLs Once launched, PavinLoader uses Windows build tools to execute malicious code. Attackers commonly bundle legitimate MSBuild executables with .csproj , .bat , .cmd , or MSI files. The project files use MSBuild features such as UsingTask and assembly-loading functions to run malicious .NET DLLs. Many of these DLLs are modified copies of legitimate open-source libraries , including DotNetZip, Nancy, Renci.SshNet, and OpenXML. The PowerShell script . Click to enlarge (Source: malwar
-
update from gbhackers.com
PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2
gbhackers.com · 49d ago · August 25th, 2026
The activity shows how attackers are moving beyond a single delivery vector. A victim may be lured to a fake Cloudflare or Google verification page and instructed to paste a command, persuaded to install apparently legitimate software, or tricked into […] The post PavinLoader Uses ClickFix and Fake Downloads to Deploy Amatera Stealer via Blockchain C2 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .