AvisLoader Malware Uses Tox Peer-to-Peer Network to Evade Traditional C2 Takedowns

The Varonis Threat Research Institute recently discovered AvisLoader, a new Windows loader named after the Latin word for “bird.” The malware was found on a public staging server alongside ClickFix lures, support tools, and a command center.

AvisLoader campaigns begin with a familiar ClickFix social-engineering lure. A webpage disguised as a document-signing request asks visitors to copy and execute attacker-provided commands on their computers.

The loader’s most notable feature is its use of Tox, an encrypted peer-to-peer (P2P) messaging network, to communicate with operators and receive commands and additional payloads.

Because the command-and-control (C2) channel does not depend on fixed domains or server addresses, traditional domain-based takedowns may be less effective. Operators can maintain the same identity while moving the controller to another server.

A seller referenced this capability in a cybercrime forum listing, claiming that the controller could be moved by copying the Tox save file and that clients could reconnect without requiring a domain.

This analysis explains how AvisLoader is delivered, how its Windows loader operates, how it uses Tox, and which indicators security teams can monitor to detect the malware.

AvisLoader Delivered Through ClickFix and Cloudflare Workers

The ClickFix lure associated with AvisLoader was hosted on Cloudflare Workers and disguised as a DocuSign document-signing request.

A fake “manual verification” dialog claimed that “verification is handled by Cloudflare” and instructed visitors to paste a “verification code” into their devices. However, the steps required to access the supposed document involved running commands.

The command copied to the clipboard downloaded and executed code from a Cloudflare Quick Tunnel address at trycloudflare.com. Although the download still took place, it bypassed the browser’s normal download flow because it was initiated through the pasted command.

Although the lure displayed macOS commands, the exposed directory contained a Windows loader. No corresponding macOS payload was found among the recovered files.

Inside the AvisLoader Windows Payload

The Windows payload is a single 3.4 MB, 64-bit executable. Its manifest specifies asInvoker, meaning that it inherits the permissions of the process that launches it and does not require User Account Control (UAC) elevation at startup.

The executable’s section table contains 17 additional sections of the same size. Their names reference well-known packers, including Themida, VMProtect, Enigma, and UPX. None of the sections are marked as executable.

These names appear intended to confuse packer identification, but their presence alone does not prove that any of the referenced packers were used.

AvisLoader Uses Tox for Peer-to-Peer C2

The payload contains a Tox client. The executable statically links to c-toxcore, the reference implementation of the Tox protocol, and retains the developer build path C:\Users\dev\Desktop\c-toxcore.

Tox allows the loader to communicate with its controller as another peer on the network. This removes the malware’s dependence on a single centralized C2 address. However, network connectivity and loader activity can still be monitored on the infected host.

AvisLoader Persistence, UAC Bypass, and Process Hiding

AvisLoader’s persistence code targets shortcuts in folders pinned to the desktop and taskbar. The executable contains a shortcut backup string and a VBScript launcher associated with the name VLCAssistant.

These artifacts indicate a mechanism designed to launch the malware when a user opens a modified shortcut while also starting the intended application, making the shortcut appear to work normally.

The recovered files also include a small helper named auto.exe that references method 41 of UACME, a public UAC-bypass project. The string identifies the ICMLuaUtil interface and the Component Object Model (COM) promotion mechanism associated with that technique.

The helper also warns that successful promotion will not be established when the helper is present, because the bypass may be mitigated by updated versions of Windows.

Another dynamic link library, hmn_hook.dll, provides process-hiding functionality. It hooks NtQuerySystemInformation, a Windows function used to retrieve process information, and filters a specified process name from the results.

This could allow the hooked function to hide a process from software that requests process information. However, the recovered file does not prove that the DLL was loaded into Task Manager or that it was used to hide AvisLoader itself.

AvisLoader Command Center Manages Infected Clients

The restored tool includes a web panel branded “AvisLoader Command Center.” It shows how operators can manage clients, configure tasks, and distribute files.

The dashboard displays the total number of online and offline clients alongside a world map.

The client table includes the hostname, country, central processing unit (CPU), graphics processing unit (GPU), antivirus product, administrator status, and public key. These fields consolidate host information in a single view, while the public key corresponds to Tox’s peer identity model.

The task controls allow operators to configure shell commands and select clients based on hardware, location, and administrator status. The controls also indicate support for tasks that run when a matching client comes online, allowing operators to prepare commands before a client connects.

The file-management tab provides an interface for staging files and describes delivery “to client via Tox.” This allows operators to prepare additional payloads for distribution.

How to Detect and Defend Against AvisLoader

AvisLoader provides security teams with several detection opportunities, including the initial ClickFix command, shortcut modifications, and unexpected Tox traffic. Recovered delivery settings and files point to four areas that defenders should monitor:

1. Suspicious command-pasting requests: Treat document-signing or verification pages that ask users to paste commands into a dialog as suspicious. Users should report these requests rather than execute them.
2. Cloudflare infrastructure used in suspicious lures: Investigate unfamiliar workers.dev and trycloudflare.com addresses when they appear in document-signing lures or commands that download and execute code. Both domains support legitimate services, so defenders should evaluate the page content and surrounding activity.
3. Command shells, script interpreters, and P2P traffic: Monitor shells and script interpreters that retrieve and execute remote code, especially after visits to suspicious webpages. Check for unexpected Tox or other peer-to-peer traffic on the same device. Commands pasted by users may run without the browser appearing as the parent process.
4. Shortcut and process-hiding artifacts: Look for modified desktop and taskbar shortcuts, associated .backup files, and references to VLCAssistant. Examine recovered auto.exe and hmn_hook.dll samples for matches, and investigate activity involving elevation attempts or process-list hooks.

What AvisLoader Reveals About Modern Malware C2

AvisLoader combines well-known malware techniques with the Tox peer-to-peer protocol. The restored Windows sample includes shortcut-persistence artifacts, while the AvisLoader Command Center supports shell tasks and file delivery over an encrypted P2P connection.

For security teams, the case demonstrates that legitimate messaging protocols can carry operator commands and additional malware. Effective detection requires examining the application behind network traffic, its behavior on the device, and the connections it establishes.

Join Varonis’ State of Cybercrime series for easy-to-understand information about data security, threat detection, AI security, and more.

Sponsored and written by Varonis.