Most malware campaigns depend on infrastructure that defenders can identify and disrupt. A malicious domain can be blocked, a command-and-control server can be taken offline, and an attacker-controlled IP address can eventually become unusable.
AvisLoader takes a different approach.
The Windows malware loader uses Tox, an encrypted peer-to-peer messaging network, as its command-and-control channel. Instead of depending on one conventional web server to issue commands, the malware communicates using a peer-based identity model that makes infrastructure disruption more complicated.
The malware was documented by Varonis Threat Labs in its September 23, 2026 research. Researchers found AvisLoader on an exposed staging server alongside a ClickFix phishing lure, supporting attack components, and a web-based command center.
The findings describe a malware ecosystem built around a familiar initial-access technique, but with a more resilient communication architecture.
What Is AvisLoader Malware?
AvisLoader is a Windows malware loader designed to establish communication with an attacker-controlled system, execute commands, and support the delivery of additional payloads.
The name comes from the Latin word avis, meaning bird.
Unlike a conventional downloader that relies on an HTTP endpoint for instructions, AvisLoader incorporates the Tox protocol to communicate with its controller.
Varonis recovered a 64-bit Windows executable approximately 3.4 MB in size. The sample statically linked c-toxcore, the reference implementation of the Tox protocol, indicating that its peer-to-peer communication capability was embedded directly in the malware.
Researchers also identified supporting components associated with privilege escalation attempts, persistence, and process hiding.
| コンポーネント | Observed purpose |
|---|---|
| AvisLoader executable | Windows loader and Tox client |
| ClickFix landing page | Social engineering delivery mechanism |
| Tox protocol | Encrypted peer-to-peer communication |
| Modified shortcuts | Potential persistence mechanism |
auto.exe | UAC bypass-related helper |
hmn_hook.dll | Process information filtering |
| Command Center | Remote client management and task configuration |
The existence of these capabilities within the recovered files does not prove that every component was successfully deployed in an actual victim environment. That distinction is important when evaluating malware research based on recovered infrastructure.
How AvisLoader Uses ClickFix for Initial Access
The delivery mechanism follows a growing trend in malware campaigns: persuading users to execute the malicious command themselves.
ClickFix attacks typically display a fabricated problem or verification requirement. Rather than relying exclusively on a malicious document attachment, the attacker presents instructions that appear to be necessary for completing an ordinary online task.
In the AvisLoader investigation, the lure impersonated a DocuSign document-signing workflow.
The page displayed a fake Cloudflare verification message, presenting command execution as part of a manual verification process.
Visitors were instructed to copy a command and run it in a terminal.
That instruction crossed the security boundary that ordinarily separates web content from local operating system execution.
A legitimate document-signing service should not require a visitor to run a terminal command merely to view or sign a document.
The command observed by Varonis retrieved and executed code through a Cloudflare Quick Tunnel address hosted under trycloudflare.com.
One important detail deserves attention: the recovered lure displayed a macOS-oriented command, while the exposed staging directory contained a Windows loader. Varonis did not identify a matching macOS payload among the recovered files.
It would therefore be inaccurate to claim that the researchers confirmed a macOS AvisLoader infection.
The evidence supports an associated social engineering delivery setup and a recovered Windows malware implementation.
Why Tox Makes AvisLoader Different
Tox is a legitimate encrypted peer-to-peer communication protocol.
It was designed to support messaging and communication without requiring the same kind of centralized infrastructure used by many traditional services.
The project itself is documented at tox.chat.
Malware authors can abuse legitimate protocols because their architectural features can also benefit malicious operations.
A conventional malware implant might periodically contact a fixed domain, retrieve commands, and send results to an HTTP server. If defenders identify that domain or infrastructure, they may be able to disrupt the communication channel through blocking or coordinated takedown.
AvisLoader uses the Tox network differently.
Its communication model depends on peer identities rather than a single permanent command server address. Varonis found evidence of a seller advertising the ability to move controller infrastructure while preserving the underlying Tox identity.
This can allow an operator to change the machine running the command system without requiring every client to be reconfigured with a new traditional C2 domain.
The important advantage is resilience, not invisibility.
Tox communication still produces observable network activity. Malware execution also creates process, file system, and host behavior that defenders can examine.
Encrypted peer-to-peer traffic can complicate payload inspection, but it does not eliminate the possibility of detecting malicious endpoint activity.
Inside the AvisLoader Executable
The Windows sample analyzed by Varonis contained several characteristics intended to complicate analysis.
Its executable manifest used asInvoker, meaning the program initially inherited the launching process’s privileges instead of automatically requesting elevation through Windows User Account Control.
The executable also contained seventeen additional sections with names resembling those associated with software packers such as Themida, VMProtect, Enigma, and UPX.
The section names could create confusion during basic static inspection. However, their presence alone does not demonstrate that the malware was packed using those products.
This distinction matters because superficial malware identification tools may make assumptions based on section names, strings, or other easily manipulated metadata.
The stronger evidence came from the embedded code and its linked dependencies.
Varonis identified statically linked Tox functionality and an embedded developer build path associated with c-toxcore.
Together, those observations support the conclusion that the loader was designed around Tox communication.
Shortcut Modification as a Persistence Mechanism
AvisLoader also contains artifacts suggesting it can modify Windows desktop and taskbar shortcuts.
Windows shortcut files, commonly ending in .lnk, contain information about the program or target that should be launched when the user activates them.
If malware modifies a shortcut, it may arrange for malicious code to execute when a user believes they are opening a legitimate application.
The recovered AvisLoader components contained references to shortcut backups and a VBScript launcher associated with the name VLCAssistant.
This suggests a mechanism in which a modified shortcut starts the malware and then launches the application the user originally expected.
The legitimate program still opens, reducing the likelihood that the user notices something unusual.
For defenders, a modified shortcut is often more revealing than the name of the executable itself.
Unexpected changes to desktop shortcuts, new backup files, or launcher scripts appearing near familiar applications should be investigated, particularly when correlated with suspicious script execution or peer-to-peer network traffic.
The UAC Bypass and Process-Hiding Components
The recovered toolkit also included a helper executable named auto.exe.
Varonis associated the helper with method 41 from UACME, a publicly known collection of techniques involving Windows User Account Control mechanisms.
The helper referenced ICMLuaUtil, an interface associated with COM-based elevation techniques.
Its presence suggests an attempt to support privilege elevation, although the researchers did not establish that the component successfully bypassed UAC on an investigated victim.
Another file, hmn_hook.dll, implemented functionality associated with filtering process information.
The DLL hooks NtQuerySystemInformation, a Windows function that applications can use to retrieve information about running processes.
By filtering specified process names from the returned data, such a component can interfere with applications that rely on that information.
However, Varonis did not confirm that this DLL had been injected into Task Manager or used to conceal the AvisLoader process in a real compromise.
These details illustrate an important malware analysis principle: a capability discovered in a recovered binary is evidence of functionality, not necessarily evidence of operational use.
The AvisLoader Command Center
Varonis also recovered a web administration interface branded as the AvisLoader Command Center.
The interface provided visibility into connected clients and supported functions for configuring tasks and distributing files.
The client inventory included information such as device hostname, country, processor characteristics, antivirus software, administrator status, and public keys.
The interface also offered targeting capabilities for selecting machines based on their characteristics.
Operators could prepare shell commands and configure tasks for clients matching particular conditions.
Another panel supported staging files for transfer to malware clients over Tox.
This shows how the peer-to-peer protocol is integrated into the malware’s operational model. It is not simply being used to transmit a short beacon. It supports the broader command and file-delivery workflow envisioned by the malware’s developer.
Again, the recovered administrative interface establishes intended functionality, not a confirmed inventory of compromised devices.
AvisLoader Indicators of Compromise
Varonis published SHA-256 hashes for the recovered Windows malware and supporting components.
| Filename | SHA-256 |
|---|---|
78324.exe | 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc |
auto.exe | f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975 |
hmn_hook.dll | cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5 |
These indicators are valuable for investigating known samples, but hash-based detection alone is insufficient against rebuilt or modified malware.
Security teams should also monitor the behavioral relationships between suspicious verification pages, local command execution, shortcut modifications, and unexpected network traffic.
How to Detect and Defend Against AvisLoader
The first detection opportunity appears before the malware executes.
A website presenting itself as a document-signing or verification service should not instruct users to run a terminal command. Security awareness training should explicitly address malicious copy-and-paste workflows, since employees may not recognize such activity as software installation.
Endpoint monitoring should investigate suspicious command interpreters that download and execute remote code shortly after a user visits an unfamiliar page.
Security teams can also look for newly modified Windows shortcuts, associated .backup artifacts, suspicious VLCAssistant references, and unexpected execution of the known helper components.
Network teams should examine unusual Tox-related communication when it correlates with suspicious endpoint behavior.
However, legitimate Cloudflare services and legitimate Tox clients should not be blocked indiscriminately based solely on domain or protocol names.
The relevant security question is whether a particular process, running in a particular context, has a legitimate reason to establish that communication.
Frequently Asked Questions
Is AvisLoader a ransomware family?
AvisLoader is primarily described as a malware loader with remote command and file-delivery capabilities. It should not automatically be classified as ransomware.
What makes AvisLoader difficult to disrupt?
Its use of Tox provides a peer-to-peer command channel that does not depend on one fixed C2 domain. The command channel is resilient, but not undetectable.
Does AvisLoader infect macOS?
The recovered delivery lure displayed a macOS command, but Varonis identified a Windows loader and did not recover a corresponding macOS payload.
Does AvisLoader successfully bypass UAC?
A UAC bypass-related helper was found, but successful privilege escalation was not established by the reviewed research.
最終的な感想
AvisLoader demonstrates how attackers are combining familiar social engineering techniques with less conventional command-and-control architectures.
The ClickFix lure shifts initial execution onto the user. The Tox-based communication layer reduces dependence on easily disrupted centralized infrastructure. Supporting components provide possible mechanisms for persistence, privilege escalation, and concealment.
For defenders, the response should be equally layered.
Blocking a malicious domain is useful, but detecting the behavior of an unauthorized loader is more durable than depending on the continued existence of one attacker-controlled server.
Japanese 
English 
German 
French 
Spanish 
Portuguese 
Korean 
Hindi 
Arabic 
Turkish 
Hebrew