Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
New Windows malware loader AvisLoader uses encrypted P2P Tox communication for C2.
A new Windows malware loader named AvisLoader has been discovered, designed to resist disruption through encrypted peer-to-peer (P2P) communication using the Tox network for its command-and-control (C2) infrastructure. This P2P approach makes traditional domain-based takedowns more difficult. The malware is delivered via a ClickFix lure hosted on Cloudflare Workers, masquerading as a document-signing request, and employs shortcut-based persistence and remote command execution capabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Varonis?
Get an email when a new story names Varonis, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAvisLoader demonstrates how modern malware combines social engineering (a fake document-signing ClickFix lure) with resilient infrastructure (Tox-based encrypted P2P C2) to bypass traditional defenses. Because the command-and-control channel relies on a decentralized P2P network rather than domains, law enforcement and defenders cannot neutralize the threat through standard domain seizure or sinkholing. The shortcut-based persistence mechanism ensures the malware survives reboots, compounding the damage if initial infection goes undetected. This matters because each layer — deceptive delivery, resilient C2, and persistent execution — is specifically engineered to outlast conventional incident response playbooks.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — AvisLoader