A new Windows malware loader, AvisLoader, was uncovered by Varonis Threat Labs and is designed to control infected machines via a web-based Command Center that exposes device details and allows issuing commands and distributing payloads through the Tox peer-to-peer network.

AvisLoader communicates with its command and control network using Tox by statically linking c-toxcore and storing a build path reference, which enables control without a fixed domain and lets operators relocate the controller by copying the Tox save file.

The name AvisLoader draws from a Latin word for bird, underscoring its furtive, bird‑like spread, and it avoids traditional domain-based C2 by leveraging an encrypted P2P channel for control.

Defensive guidance emphasizes not clicking Run or PowerShell prompts from dubious pages, ignoring unsolicited document signing requests, closing suspicious pages, and reporting them to security teams.

The infection chain starts with a ClickFix lure hosted on a Cloudflare Workers page that imitates a DocuSign signature request, prompting users to paste a code into a terminal, after which a Windows payload is downloaded and executed.

The Windows payload is a 3.4 MB 64‑bit executable that runs with standard privileges (asInvoker) and uses multiple packer-related sections to complicate analysis, with no macOS payload found in the exposed directory.

The loader can persist by modifying desktop and taskbar shortcuts and uses a VBScript launcher (VLCAssistant); it includes components like auto.exe (potential UAC bypass via UACME method 41) and hmn_hook.dll (possible process hiding), though evidence of active privilege escalation is not conclusive.

From the web-based AvisLoader Command Center, attackers gain visibility into infected machines—location, hardware, antivirus status, and admin privileges—and can issue commands and push additional files through the Tox network.

The centralized control flow is supported by a catalog of techniques that create a chain from lure to payload, with the loader enabling ongoing access and potential stealth features to evade detection.