Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
New Windows malware loader AvisLoader uses encrypted P2P Tox communication for C2.
Run Varonis?
Get an email when a reviewed story names Varonis, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A new Windows malware loader named AvisLoader has been discovered, designed to resist disruption through encrypted peer-to-peer (P2P) communication using the Tox network for its command-and-control (C2) infrastructure. This P2P approach makes traditional domain-based takedowns more difficult. The malware is delivered via a ClickFix lure hosted on Cloudflare Workers, masquerading as a document-signing request, and employs shortcut-based persistence and remote command execution capabilities.
The lesson from this incident
Full lessonAvisLoader demonstrates how modern malware combines social engineering (a fake document-signing ClickFix lure) with resilient infrastructure (Tox-based encrypted P2P C2) to bypass traditional defenses. Because the command-and-control channel relies on a decentralized P2P network rather than domains, law enforcement and defenders cannot neutralize the threat through standard domain seizure or sinkholing. The shortcut-based persistence mechanism ensures the malware survives reboots, compounding the damage if initial infection goes undetected. This matters because each layer — deceptive delivery, resilient C2, and persistent execution — is specifically engineered to outlast conventional incident response playbooks.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
- malware — AvisLoader