Varonis researchers uncover AvisLoader, a Windows malware using encrypted P2C2

Varonis Threat Labs researchers recently identified AvisLoader, a new Windows malware loader designed to resist disruption through encrypted peer-to-peer communications. The team discovered the threat on an exposed staging server, where it was hosted alongside supporting tools, a Command Center, and a ClickFix delivery lure. The malware is named after the Latin word for bird, according to the Varonis report.

The most distinct feature of AvisLoader is its use of the Tox messaging network to maintain command-and-control (C2) connectivity. Instead of relying on traditional domain-based servers, the malware uses this encrypted peer-to-peer channel to receive commands and additional payloads from operators. This architecture makes standard domain takedowns ineffective, as the C2 infrastructure does not depend on a fixed server address or domain name.

Technical Mechanics and Delivery

The attack chain begins with a ClickFix lure hosted on Cloudflare Workers, designed to resemble a legitimate DocuSign document-signing request. The fake page displays a "Manual verification" dialog that claims verification is handled by Cloudflare and asks visitors to paste a code into their terminal. This social engineering tactic pressures users to execute a command to access the document, bypassing normal browser download protections.

The command presented to the victim retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com. Although the lure interface displays a macOS command, the exposed directory contained only a Windows payload. Varonis researchers did not find a corresponding macOS executable among the recovered files, indicating the current campaign targets Windows systems exclusively.

Persistence and Privileges

The AvisLoader payload is a single 64-bit executable with a file size of 3.4 MB. Its manifest specifies asInvoker privileges, meaning the malware inherits the permission level of the process that launches it. This configuration allows the loader to run without requesting User Account Control (UAC) elevation at startup, potentially avoiding additional security prompts that might alert the user.

Operators can maintain control even if they move servers, as the seller referenced in a cybercrime forum listing claims the controller can be relocated by copying its Tox save file. Clients follow the operator without needing a new domain, preserving the attacker's identity and connection stability. This portability further complicates remediation efforts for security teams tracking the threat.

What should you do?

Security teams should monitor for unusual terminal activity or commands pasted from web pages, particularly those involving Cloudflare Quick Tunnel addresses. Endpoint detection solutions should be tuned to identify the specific behaviors of AvisLoader, including its use of the Tox protocol for outbound traffic. Organizations should also review exposed staging servers and ensure that development environments are not accessible to the public internet.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: AvisLoader

• Monitor endpoint logs for commands executed via terminal that originate from web-based social engineering lures, especially those referencing verification codes.
• Inspect outbound network traffic for connections to known peer-to-peer networks like Tox, which may indicate compromised hosts communicating with C2 infrastructure.
• Verify that staging servers and development environments are properly secured and not exposed to the public internet to prevent malware distribution.
• Educate users on the risks of ClickFix attacks and the importance of not running commands copied from web pages, even if they appear to be from trusted services.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the primary method AvisLoader uses to communicate with its operators?

AvisLoader uses the Tox encrypted peer-to-peer messaging network to carry commands and payloads, avoiding reliance on fixed domains or servers.

How does the initial infection vector typically present itself to victims?

The infection starts with a ClickFix lure on a fake DocuSign signing page that asks users to paste a verification command into their terminal.

What privileges does the AvisLoader executable run with on Windows systems?

The 3.4 MB executable runs with asInvoker privileges, inheriting the rights of the launching process without requesting UAC elevation.