Varonis Threat Labs found AvisLoader, a Windows loader whose C2 runs over the Tox P2P network with no fixed domain. Varonis says that makes domain takedowns harder, though the Tox connections stay observable next to the loader's activity on the host.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence65
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+5
- Incentives40
- Confidence70
AvisLoader statically links the reference Tox client, so its operator keeps the same identity after moving to a new server. The ClickFix page and Cloudflare tunnel that deliver it are still ordinary takedown targets.
Publishers:varonis.com
Reality
- Evidence66
- Adoption20
- Hype gap+18
- Incentives62
- Confidence57
buildOne report1 publisher Since uv 0.12.0 landed on July 28, 2026, uv init has written a src layout and a uv_build build-system table by default. The old --package tip is now backwards, and --no-package is the way back to a flat main.py.
Reality
- Evidence68
- Adoption48
- Hype gap−12
- Incentives58
- Confidence62
Joe Security's teardown of an AArch64 Tox botnet shows a model proposing actions that only an operator command executes, which puts the telemetry worth collecting on the controller rather than on any victim host.
Publishers:joesecurity.org
Reality
- Evidence64
- Adoption18
- Hype gap−12
- Incentives55
- Confidence58