HijackLoader

Tracking PavinLoader across ClickFix and fake download campaigns - Malware News - Malware Analysis, News and Indicators

Researchers linked PavinLoader, a multi-stage .NET malware loader, to several intrusion chains that used ClickFix lures, fake software downloads, and malicious RenPy packages to infect victims. Across the campaigns, operators relied on trojanized and heavily obfuscated .NET DLLs, along with abuse of MSBuild through .csproj and .bat files, to execute later stages while complicating analysis and detection. The loader retrieved command-and-control details using EtherHiding, including Binance Smart Chain RPC calls to pull infrastructure data from blockchain-hosted content, and then fetched additional payloads. In observed cases, PavinLoader delivered Amatera Stealer and at times HijackLoader, while also using anti-analysis and anti-forensics measures such as AMSI/ETW-related evasion strings, virtualization checks, locale filtering, and infrastructure-provider checks; shared artifacts and builder-like scripts led researchers to assess that it may be operated as a Loader-as-a-Service, though no commercial panel or offering was confirmed.

Tracking PavinLoader across ClickFix and fake download campaigns | Malwarebytes

Faux jeux distribuent Amatera Stealer via RenPy Loader, MSBuild et EtherHiding | CyberVeille

Threat actors are distributing fake games, mods, cracks, and software installers that abuse the legitimate Ren’Py visual novel engine to launch a multi-stage malware chain ending in Amatera Stealer. Researchers said the initial RenPy Loader (also called RenEngine Loader) extracts an encrypted ZIP archive, runs a BAT file through forfiles.exe, and then uses MSBuild to execute a trojanized .NET component, advancing the infection through several downloader and anti-analysis stages. The later stages include anti-sandbox checks, removal of the Mark-of-the-Web via the Zone.Identifier alternate data stream, and reflective loading of a malicious Nancy .NET component before the stealer is decrypted and executed. The campaigns were hosted on fake download sites, itch.io pages, and file-sharing services, and used the EtherHiding technique to pull command-and-control details from blockchain data, complicating infrastructure takedowns and attribution; published indicators include malicious domains, IP addresses, and file hashes tied to the downloader, loader, and final payload.

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding - Malware News - Malware Analysis, News and Indicators

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding | Malwarebytes

How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | Community Portal | Gurucul

Attackers compromised the Artlist WordPress subdomain new-blog.artlist[.]io and used it to deliver a sophisticated ClickFix malware campaign that presented visitors with a fake CAPTCHA and tricked them into running PowerShell. The injected JavaScript used an EtherHiding technique, querying a Polygon smart contract to dynamically retrieve the next-stage host auth-code-check[.]info, then downloaded a multi-stage infection chain from the attacker-controlled backend. Researchers traced the intrusion to WordPress credentials stolen from an Israeli freelance developer whose machine had been infected by an infostealer after downloading a pirated copy of Adobe Acrobat Pro DC in 2023. The payload chain reportedly used a password-protected archive, a signed StruSoft/FEM-Design updater, and DLL side-loading to decode shellcode and load a final native RAT that supported encrypted and Tor-backed C2, browser credential theft, keylogging, clipboard and screen access, hidden desktop interaction, file transfer, shell and process control, SOCKS proxying, service installation, and in-memory PE delivery.

Artlist ClickFix Page Dropped a Native Windows RAT

How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | InfoStealers