Tracking PavinLoader across ClickFix and fake download campaigns

Reported 25 Aug 2026 by otx · Severity: medium

A sophisticated multi-stage loader dubbed PavinLoader has been identified across multiple distribution campaigns including ClickFix attacks, fake software downloads, and malicious RenPy games. The loader employs heavily obfuscated .NET DLLs, abuses legitimate Windows tools like M