Description
PavinLoader is a multi-stage .NET malware loader documented by Malwarebytes in August 2026. Campaigns distribute it through ClickFix fake CAPTCHA lures, counterfeit software downloads, and trojanized Ren'Py game installers, and its infection chains abuse legitimate Windows tools such as MSBuild alongside trojanized versions of common .NET libraries. It resolves command-and-control domains through EtherHiding lookups against BNB Smart Chain contracts, and primarily delivers information stealers, including Amatera Stealer.
Stats
Threat Stats →Trailing four weeks, updated daily (last updated October 19, 2026 at 16:52 UTC).
Rising
Global rank
#12 ▲ from #879
Vs. previous four weeks
+1840%
Daily trend
By region
#2 · Asia#13 · Africa#19 · Middle East#24 · Oceania#28 · North America
By industry
#3 · Technology#9 · Manufacturing#12 · SLED#13 · Healthcare#33 · Telecom#34 · Financial Services#46 · Retail