Security1 publisher3 min readPublished
A Windows loader for sale on a crime forum takes its orders over Tox peer-to-peer messaging
AvisLoader statically links the reference Tox client, so its operator keeps the same identity after moving to a new server. The ClickFix page and Cloudflare tunnel that deliver it are still ordinary takedown targets.
The Watch · Security desk
What happened
- Varonis Threat Labs found AvisLoader, a Windows loader, on an exposed staging server together with a ClickFix lure, supporting tools and the operator's command center.
- The lure ran on Cloudflare Workers as a DocuSign signing request, with a fake verification dialog attributing the check to Cloudflare and telling visitors to paste a code into a terminal.
- The pasted command retrieves and runs code from a Cloudflare Quick Tunnel on trycloudflare.com, so the download happens outside the browser's normal download flow.
- The loader talks to its operator over Tox, an encrypted peer-to-peer messaging network that carries both commands and additional payloads with no fixed domain or server address.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Blocklists and sinkholes keyed to domains or IPs miss the AvisLoader C2 leg entirely, so the durable detections are host artifacts and the presence of Tox traffic itself.
- capability Server portability becomes a feature a seller can advertise: one file copied, the installed base intact, clients reconnecting without re-registration or re-seeding.
- decision Abuse reporting to Cloudflare remains the leverage that cuts new installs. The response burden sits on provider response times.
- contradiction Varonis calls domain-based takedowns harder while also saying the connections stay observable, so the channel resists seizure while staying visible to a defender who watches the host.
According to the forum listing Varonis found, moving the AvisLoader controller is a matter of copying its Tox save file, after which clients reconnect without needing a domain [5]. Varonis describes the command channel the same way: no dependence on a fixed domain or server address, and the operator keeps the same identity when it moves to another server [4]. Commands and follow-on payloads both ride the Tox network [4].
What defenders keep is the traffic and the host. Varonis notes the loader's network connections stay observable alongside its activity on the box [6]. Tox protects the channel after install. The page that gets the victim to paste the command is still ordinary infrastructure: the DocuSign-themed lure ran on Cloudflare Workers [2], and the pasted command pulled code from a Quick Tunnel on trycloudflare.com [3]. Two of the three network dependencies in the recovered chain sit on Cloudflare properties and can be reported [15].
The payload is a single 3.4 MB 64-bit executable whose manifest is asInvoker, so it inherits the privileges of whatever launched it and does not ask for elevation at startup [7]. With ClickFix, what launched it is the user's own terminal. The section table carries seventeen extra sections of identical size, named after Themida, VMProtect, Enigma and UPX, none of them marked executable; Varonis describes the names as intended to confuse packer identification and says they do not establish that any of those packers was used [8]. The binary statically links c-toxcore, the reference Tox implementation, and still contains the developer's build path C:\Users\dev\Desktop\c-toxcore [9].
Persistence works on desktop and taskbar-pinned shortcuts, using shortcut-backup strings and a VBScript launcher named VLCAssistant so that opening a modified shortcut starts the malware and then the application the user wanted [10]. Two helpers came off the same server. auto.exe references method 41 from the public UACME project, with strings for the ICMLuaUtil interface and COM elevation [11]. hmn_hook.dll hooks NtQuerySystemInformation and filters a named process out of the results [12]. Varonis is explicit that neither is confirmed to have worked: auto.exe itself warns that updated Windows versions may mitigate the bypass, and the recovered files do not show the DLL loaded into Task Manager or hiding AvisLoader [11][12].
One more mismatch in the recovered directory: the lure displayed a macOS command, the payload was a Windows loader, and Varonis did not find a macOS build among the files [13].
The evidence is one sample from one exposed staging server [1], plus a listing offering the loader for sale [14]. The claim it supports is about AvisLoader alone. The indicators that survive an operator changing servers are on the host: the modified desktop and taskbar shortcuts, the VLCAssistant VBScript, and the c-toxcore build path left in the binary [9][10].
What to watch
- Whether Cloudflare removes the Workers-hosted lure page and the trycloudflare.com Quick Tunnel, and how quickly the operator stands them back up.
- Further samples tied to the same Tox identity. Those would show whether one buyer or several are running the loader.
- A macOS payload surfacing. That would say whether the macOS command in the lure was live or copied in.