AvisLoader: New Windows malware uses Tox network to resist takedowns

Varonis researchers find loader distributed through DocuSign-themed ClickFix lure

By LineZotpaper

Published13 October 2026

Read Time2 min

Security researchers at Varonis Threat Labs have discovered a new Windows malware loader, named AvisLoader, that uses the encrypted Tox peer-to-peer messaging network for command and control, a design that makes traditional domain-based takedowns difficult.

Varonis Threat Labs said it found AvisLoader, a Windows loader named after the Latin word for bird, on an exposed staging server alongside a ClickFix lure, supporting tools and its Command Center.

The attack begins with a ClickFix lure hosted on Cloudflare Workers and styled as a DocuSign signing request. A fake "Manual verification" dialog claiming "Verification is handled by Cloudflare" asks visitors to paste a "verification code" into a terminal. The pasted command retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com, so the download happens outside the browser's normal download flow.

Although the lure displayed a macOS command, the exposed directory contained a Windows loader, and no corresponding macOS payload was found among the recovered files.

The more unusual element is how AvisLoader maintains contact with its operator. It communicates via Tox, an encrypted peer-to-peer messaging network that carries commands and additional payloads. Because the command-and-control channel does not depend on a fixed domain or server address, operators can keep the same identity when moving to another server.

The seller references this in a cybercrime forum listing, claiming the controller can be moved by copying its Tox save file, with clients following without the need for a domain.

The Windows payload is a single 3.4 MB 64-bit executable. Its manifest specifies asInvoker, meaning it inherits the privileges of the process that launches it without requesting User Account Control elevation at startup. Its section table contains seventeen additional sections of identical size, with names associated with well-known packers.

Varonis detailed the MITRE ATT&CK techniques the loader uses and indicators security teams can use to detect it.

Analysis

Why This Matters

Command-and-control over Tox removes the fixed domains and server addresses that defenders and law enforcement typically seize to disrupt a campaign.
The ClickFix lure abuses legitimate Cloudflare infrastructure, making malicious activity harder to distinguish from normal traffic.
Loaders are the delivery stage for more serious follow-on activity, including data theft and ransomware.

Background

Malware loaders are first-stage tools that install and run additional malicious payloads on compromised machines. ClickFix is a social engineering technique that tricks users into running attacker-supplied commands by presenting them as verification steps. Tox is a well-established encrypted peer-to-peer messaging network, and its decentralised design is what makes the loader's command channel harder to switch off.

Key Perspectives

Security teams: Blocking a single domain will not disrupt this campaign, so defenders are likely to rely on behavioural detection, endpoint controls and monitoring for the specific indicators Varonis published. The sellers: The cybercrime forum listing markets portability as a headline feature, with operators able to move their controller simply by copying a Tox save file. Skeptics: The findings are based on a single exposed staging server, the lure displayed a macOS command but no macOS payload was found, and it remains unclear how widely the loader has been adopted.

What to Watch

Whether other cybercriminal groups begin adopting Tox-based command and control.
Whether detection coverage for AvisLoader appears in mainstream security products.
Whether abuse of Cloudflare Quick Tunnel and Workers for ClickFix lures prompts any response from Cloudflare.

Sources

Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption — BleepingComputer