Tracking PavinLoader across ClickFix and fake download campaigns

PavinLoader is a versatile, heavily obfuscated multi-stage malware loader used across diverse campaigns—including ClickFix and fake software downloads—that leverages legitimate Windows tools, blockchain-based EtherHiding for C2 concealment, and delivers information-stealing payloads like Amatera Stealer, indicating possible Loader-as-a-Service activity.