New Windows loader AvisLoader leans on Tox for resilient C2
Varonis Threat Labs found a new Windows loader called AvisLoader on an exposed staging server. It is delivered via a ClickFix lure that mimics a document-signing request and relies on Tox encrypted peer-to-peer messaging for command-and-control, which complicates domain-based takedowns. The malware also uses shortcut persistence and can execute remote commands.
Varonis Threat Labs found AvisLoader on an Internet-exposed staging host, together with a ClickFix decoy, auxiliary tools, and a control panel. The decoy posed as a document-signing page and told visitors to paste an attacker-provided command, which pulled code through a Cloudflare Quick Tunnel instead of a standard browser download.
The Windows payload is a 3.4 MB 64-bit executable that inherits the launching process's privileges and does not seek UAC elevation. It statically links c-toxcore, uses Tox peer-to-peer messaging for commands and payloads, and carries misleading packer section names. Its persistence targets desktop and taskbar-pinned shortcuts, including a VBScript launcher named VLCAssistant.
This development may make disruption harder for defenders because Tox-based C2 avoids fixed domains, potentially affecting organizations targeted by ClickFix lures and users who run pasted commands. Security teams could face more complex detection and takedown efforts, while victims may experience remote command execution, persistence, and additional payload delivery. The broader trend could encourage copycat loaders that prioritize resilient peer-to-peer infrastructure over centralized servers.