Tracking PavinLoader across ClickFix and fake download campaigns

In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads. Despite differences in how these campaigns reach victims, we found several common elements.