New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2
New AvisLoader malware uses Tox P2P for C2 and a ClickFix lure.
Varonis Threat Labs has identified AvisLoader, a new malware loader targeting Windows systems. This malware employs a malicious 'ClickFix' lure to gain initial access and utilizes the Tox peer-to-peer network for its command and control (C2) infrastructure, making it more resilient to takedowns.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Varonis?
Get an email when a new story names Varonis, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAvisLoader targets Windows users by leveraging a ClickFix social engineering lure, tricking users into executing malicious code under the guise of a legitimate fix or prompt. By routing command and control traffic through the Tox peer-to-peer network, the malware avoids traditional domain-based detection and takedown efforts, making it significantly harder for defenders to disrupt. This highlights how attackers are combining human manipulation with decentralized infrastructure to maximize resilience and evade conventional defenses. Organizations that lack user awareness training and robust outbound traffic monitoring are especially vulnerable to this class of threat.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — AvisLoader