SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
AvisLoader receives its commands over Tox, a peer-to-peer network that does not depend on a fixed domain
Varonis Threat Labs found AvisLoader, a Windows loader whose C2 runs over the Tox P2P network with no fixed domain. Varonis says that makes domain takedowns harder, though the Tox connections stay observable next to the loader's activity on the host.
The Watch · Security desk
What happened
- Varonis found the loader on an exposed staging server that also held a ClickFix lure, supporting tools and the operator's Command Center.
- The payload is a single 3.4 MB 64-bit executable that statically links c-toxcore, the reference implementation of the Tox protocol.
- Persistence targets shortcuts on the desktop and in the taskbar-pinned folder, launching the malware and then the application the user meant to open.
Why it matters
- constraint A C2 domain blocklist has no entry to hold for this loader. Detection has to key on the host activity and the Tox connections that appear together.
- decision The payload fetch happens in the pasted command, outside the browser's download path, so the control point is the endpoint that runs the command.
- exposure A user who pastes the command hands the loader their own privileges, because the manifest asks for no UAC elevation at startup.
Varonis says the Tox setup makes traditional domain-based takedowns harder [9]. The reason is that no fixed domain or server address anchors the C2 channel, and operators who move to another server can carry the same identity with them [9]. Tox is an encrypted peer-to-peer messaging network, and it carries both commands and additional payloads from the operator [8].
The seller's forum listing goes further. It claims that copying the controller's Tox save file is enough to relocate it, and that clients follow it there without needing a domain [17]. That is a sales claim, and Varonis reports it as the seller's.
Takedown still has targets earlier in the chain. The lure Varonis found was hosted on Cloudflare Workers and dressed as a DocuSign signing request [3]. The command it puts on the clipboard fetches and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com [4].
Varonis says the peer-to-peer design removes reliance on a single central address, but the network connections remain observable alongside the loader's activity on the host [10]. The binary statically links c-toxcore, the reference Tox implementation [6], and it retains the developer's build path [7]. Varonis says its post covers the MITRE ATT&CK techniques and the indicators teams can use to detect the loader [16]. The excerpt we have does not reproduce the indicator list, give a discovery date or report any victims.
The staging directory held more than the loader. A helper, auto.exe, references method 41 from UACME, a public UAC bypass project. Varonis notes that updated Windows versions may mitigate it and that its presence does not establish successful elevation [14]. A DLL, hmn_hook.dll, hooks NtQuerySystemInformation to filter a named process from the results, and the recovered files do not establish that it was loaded into Task Manager or used to hide AvisLoader [15]. The section table carries seventeen extra sections of identical size named after packers including Themida, VMProtect, Enigma and UPX, none marked executable, and Varonis says the names alone do not show any of those packers was used [12].
Persistence is the easier host signal to check. The code targets shortcuts on the desktop and in the taskbar-pinned folder, with a VBScript launcher tied to the name VLCAssistant, so a modified shortcut starts the malware and then opens the intended application [13]. We think a rule for shortcut changes in those two locations is worth having, because it does not depend on seeing Tox traffic.
One mismatch in the staging data: the lure displays a macOS command, while the exposed directory held a Windows loader, and Varonis did not find a macOS payload among the recovered files [5].
What to watch
- Any report of AvisLoader running in a victim environment, which would show whether the UACME helper and the process-hiding DLL are used outside the staging server.
- A macOS payload turning up to match the lure's macOS command.
- Evidence that a controller has moved by Tox save file, as the seller's listing claims.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Varonis Threat Labs discovered AvisLoader, a new Windows loader named after the Latin word for bird.
- [2]
Varonis found AvisLoader on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center.
- [3]
The ClickFix lure found alongside AvisLoader was hosted on Cloudflare Workers and made to look like a DocuSign signing request.
- [4]
The command placed on the clipboard retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com, so the download takes place through the pasted command, outside the browser's normal download flow.
- [5]
Although the lure shows a macOS command, the exposed directory contained a Windows loader, and Varonis did not find a corresponding macOS payload among the recovered files.
- [6]
The Windows payload is a single 3.4 MB 64-bit executable that statically links c-toxcore, the reference implementation of the Tox protocol.
- [7]
The executable retains the developer's build path, C:\Users\dev\Desktop\c-toxcore.
- [8]
Tox is an encrypted peer-to-peer messaging network that carries commands and additional payloads from the operator to AvisLoader.
- [9]
The Tox setup makes traditional domain-based takedowns harder: the C2 channel does not depend on a fixed domain or server address, and operators can keep the same identity when moving to another server.
- [10]
Using Tox removes reliance on a single centralized command-and-control address, but the network connections remain observable alongside the loader's activity on the host.
- [11]
The executable's manifest specifies asInvoker, meaning it inherits the privileges of the process that launches it without requesting UAC elevation at startup.
- [12]
The executable's section table contains seventeen additional sections of identical size, with names associated with well-known packers including Themida, VMProtect, Enigma, and UPX; none is marked executable, and the names alone do not establish that any of those packers was used.
- [13]
AvisLoader's persistence code targets shortcuts on the desktop and in the taskbar-pinned folder, with shortcut-backup strings and a VBScript launcher associated with the name VLCAssistant, indicating a mechanism that launches the malware when a user opens a modified shortcut and then starts the intended application so it appears to open normally.
- [14]
The recovered helper auto.exe references method 41 from UACME, a public UAC bypass project; it warns that updated Windows versions may mitigate the bypass, so its presence does not establish successful elevation.
- [15]
The DLL hmn_hook.dll hooks NtQuerySystemInformation and filters a specified process name from the results; the recovered files do not establish that it was loaded into Task Manager or used to hide AvisLoader itself.
- [16]
Varonis' post looks at how AvisLoader works, the MITRE ATT&CK techniques it uses, and the indicators security teams can use to detect it.
- [17]
The seller references this in a cybercrime forum listing, claiming the controller can be moved by copying its Tox save file, with clients following without the need for a domain.
ReportedContestedSource: Varonis Threat Labs, describing the seller's forum listingView cited source
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comInside AvisLoader: A Windows Malware Loader Built to Resist Disruption
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- ClickFix-Style Social EngineeringFollow
- Malware loaders and delivery chainsFollow
- Peer-to-peer command and controlFollow