Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption

AvisLoader is a Windows malware loader discovered by Varonis Threat Labs that uses the Tox encrypted peer-to-peer (P2P) network for command-and-control (C2) communications, making takedowns more difficult. The infection begins with a ClickFix lure hosted on Cloudflare Workers, mimicking a DocuSign signing request, which tricks users into pasting and executing a malicious command. The loader employs shortcut modification for persistence, includes a UAC bypass helper referencing UACME technique 41, and uses a DLL to hook system calls for process hiding. The associated AvisLoader Command Center allows operators to manage clients, execute remote commands, and distribute payloads over Tox.

AI-extracted · verify before operational use