[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flLmfrG3utP5VViCyFF3hThT6DwM-te3iK20sZDCUU4w":3},{"article":4,"iocs":38,"watch_terms":42,"solutions":43,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"b21fb049-67d4-40da-8956-e7f67fd6fff3","New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2","new-avisloader-windows-malware-uses-clickfix-lure-and-tox-p2p-for-c2-db1063","Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.","Varonis Threat Labs has identified AvisLoader, a new malware loader targeting Windows systems. This malware employs a malicious 'ClickFix' lure to gain initial access and utilizes the Tox peer-to-peer network for its command and control (C2) infrastructure, making it more resilient to takedowns.","New AvisLoader malware uses Tox P2P for C2 and a ClickFix lure.","https:\u002F\u002Fhackread.com\u002Favisloader-windows-malware-clickfix-tox-p2p-c2\u002F",null,"2026-09-24T09:52:07+00:00","2026-09-24T10:00:35.293318+00:00",8,[17,20,23],{"name":18,"type":19},"Windows","product",{"name":21,"type":22},"Tox","technology",{"name":24,"type":25},"Varonis","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":12,"name":28,"slug":29},"Malware","malware",[31,33],{"category":32},{"id":26,"icon":12,"name":28,"slug":29},{"category":34},{"id":35,"icon":12,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":29,"value":40,"context":41},"AvisLoader","Name of the discovered malware loader",[24,18],{"controls":44,"vendors":129},[45,74,100],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":75,"name":76,"problem":77,"products":78},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[79,87,92],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":88,"product_name":89,"url":90,"description":91},"prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":101,"name":102,"problem":103,"products":104},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[130],{"slug":106,"name":107,"logo_path":108,"roles":131},[132],"affected",{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":149},"avisloader-exploits-clickfix-social-engineering-and-tox-p2p-for-resilient-c2","AvisLoader Exploits ClickFix Social Engineering and Tox P2P for Resilient C2","AvisLoader targets Windows users by leveraging a ClickFix social engineering lure, tricking users into executing malicious code under the guise of a legitimate fix or prompt. By routing command and control traffic through the Tox peer-to-peer network, the malware avoids traditional domain-based detection and takedown efforts, making it significantly harder for defenders to disrupt. This highlights how attackers are combining human manipulation with decentralized infrastructure to maximize resilience and evade conventional defenses. Organizations that lack user awareness training and robust outbound traffic monitoring are especially vulnerable to this class of threat.",[138,139,140,141,142,143,144,145,146,147,148],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1204: User Execution","MITRE ATT&CK T1090: Proxy (P2P)","MITRE ATT&CK T1059: Command and Scripting Interpreter",{}]