Reported by 1 outlet
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 1.00 / 2.0 · updates in 48h
- Pickup speed
- 0.43 / 0.6 · time to second source
- Recency
- × 0.42 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 1.8 / 10 = base × recency + community
Analysis
Varonis Threat Labs found AvisLoader, a Windows loader that uses Tox encrypted peer-to-peer messaging for C2 instead of fixed domains. The loader was discovered on an exposed staging server with a ClickFix lure posing as a document-signing request. Because C2 relies on a P2P identity rather than a domain, traditional takedowns are harder; the operator can move the controller by copying its Tox save file.
The event connects to MITRE ATT&CK techniques, uses a Cloudflare Workers-hosted lure mimicking DocuSign, and carries a fake verification dialog that asks the victim to paste an attacker-supplied command. Security teams should watch for Tox-based P2P C2 traffic and ClickFix-style command execution lures.
No CVEs are assigned to this malware family in the event content, and exploitation status is unclaimed. The primary source is the Varonis/Threat Labs disclosure linked via BleepingComputer.
Timeline
-
original reporting
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
bleepingcomputer.com · 1d ago · October 12th, 2026
Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center. The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine. The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator. That setup makes traditional domain-based takedowns harder. The command-and-control (C2) channel does not depend on a fixed domain or server address, and operators can keep the same identity when moving to another server. The seller references this in a cybercrime forum listing, claiming the controller can be moved by copying its Tox save file, with clients following without the need for a domain. In this post, we look at how AvisLoader works, the MITRE ATT&CK techniques it uses, and the indicators security teams can use to detect it. The specific ClickFix lure we found alongside AvisLoader was hosted on Cloudflare Workers and made to look like a DocuSign signing request. A fake “Manual verification” dialog claims “Verification is handled by Cloudflare” and asks visitors to paste a “verification code” into a terminal. It presents running the command as a step needed to access the document. What l
-
update from www.bleepingcomputer.com
🤖 Varonis details AvisLoader, a Windows loader that uses encrypted peer-to-peer comms to keep its C2 reachable even when infrastructure is s
www.bleepingcomputer.com · 1d ago · October 12th, 2026
🤖 Varonis details AvisLoader, a Windows loader that uses encrypted peer-to-peer comms to keep its C2 reachable even when infrastructure is s
via Mastodon https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/