AvisLoader Exploits ClickFix Social Engineering and Tox P2P for Resilient C2

AvisLoader targets Windows users by leveraging a ClickFix social engineering lure, tricking users into executing malicious code under the guise of a legitimate fix or prompt. By routing command and control traffic through the Tox peer-to-peer network, the malware avoids traditional domain-based detection and takedown efforts, making it significantly harder for defenders to disrupt. This highlights how attackers are combining human manipulation with decentralized infrastructure to maximize resilience and evade conventional defenses. Organizations that lack user awareness training and robust outbound traffic monitoring are especially vulnerable to this class of threat.

Tactical Insight

Immediate actions

Train users to recognize and report ClickFix-style prompts that instruct them to paste or run scripts in PowerShell or the Run dialog.
Block or alert on outbound connections to known Tox network nodes and unusual peer-to-peer protocols at the perimeter firewall.
Deploy endpoint detection and response (EDR) tools configured to flag suspicious loader activity and unexpected process execution chains.

Long-term improvements

Implement application allowlisting to prevent unauthorized executables and scripts from running on Windows endpoints.
Enforce least-privilege principles so standard users cannot execute administrative commands triggered by social engineering lures.
Establish a formal security awareness program with phishing and social engineering simulations conducted at least quarterly.

Detection measures

Monitor and alert on anomalous outbound P2P traffic patterns or connections to non-standard ports using network traffic analysis tools.
Collect and centralize endpoint logs to detect loader behaviors such as in-memory execution, process injection, or unusual parent-child process relationships.
Integrate threat intelligence feeds that include indicators of compromise (IOCs) for AvisLoader and ClickFix campaigns into your SIEM.

Framework References

CIS Control 2: Inventory and Control of Software AssetsCIS Control 9: Email and Web Browser ProtectionsCIS Control 13: Network Monitoring and DefenseCIS Control 14: Security Awareness and Skills TrainingNIST SP 800-53 AT-2: Literacy Training and AwarenessNIST SP 800-53 SI-3: Malicious Code ProtectionNIST SP 800-53 SC-7: Boundary ProtectionNIST SP 800-53 AU-6: Audit Record Review, Analysis, and ReportingMITRE ATT&CK T1204: User ExecutionMITRE ATT&CK T1090: Proxy (P2P)MITRE ATT&CK T1059: Command and Scripting Interpreter

Source

ThreatNoir coverageNew AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2 Read originalNew AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2

PublishedSep 24, 2026