A new Windows malware loader called AvisLoader is using an encrypted peer-to-peer (P2P) messaging network to communicate with its operators, making it harder to disrupt through traditional domain takedowns.
Cybersecurity researchers at Varonis Threat Labs discovered AvisLoader on an exposed staging server alongside a ClickFix lure, supporting tools, and a web-based command center. They named it after the Latin word for bird.
According to Varonis researcher Daniel Kelley, AvisLoader uses Tox, a peer-to-peer messaging network that does not rely on a fixed command-and-control domain or server address.
Social Engineering and Execution Mechanics
Varonis’ research blog shared with Hackread.com reveals that the infection chain begins with a ClickFix lure designed to trick users into running an attacker-supplied command. The attack chain begins when targets visit a web page hosted on Cloudflare Workers. This page is disguised as a DocuSign signature request and displays a prompt claiming that “Verification is handled by Cloudflare.”
The page then asks the visitor to paste a code into a terminal, presenting it as a step required to access the document. The clipboard contents include a command pointing to a Cloudflare Quick Tunnel address on trycloudflare.com. When executed, the command retrieves and runs code outside the browser’s normal download process.
Although the lure displayed a macOS command, the exposed directory contained a Windows loader. Varonis did not find a corresponding macOS payload among the recovered files.
The Windows payload is a 3.4 MB 64-bit executable. Its manifest specifies asInvoker (runs with the launcher’s existing privileges), so it does not request UAC elevation at startup. Its section table also contains 17 additional sections of identical size with names associated with common packers, including UPX, VMProtect, Themida and Enigma. None was marked executable, and Varonis assessed that the names were probably intended to confuse packer identification.
Command-and-Control via Tox
AvisLoader statically links c-toxcore, the reference implementation of the Tox protocol, and retains the developer’s build path C:UsersdevDesktopc-toxcore. The loader uses this component to communicate with its controller without depending on a fixed domain or server address.
This makes conventional domain-based takedowns harder. In a cybercrime forum listing, the seller claimed that operators could move the controller by copying its Tox save file, allowing clients to follow the same identity without a domain update.
What AvisLoader Can Do
Varonis found that AvisLoader is designed to remain active by modifying shortcuts on the desktop and taskbar. When a victim opens an affected shortcut, the malware can run first and then launch the expected application, making the change less obvious. The recovered files included shortcut backups and a VBScript launcher named VLCAssistant.
The malware package also contained auto.exe, a program linked to a publicly documented Windows UAC bypass known as UACME method 41. This could help AvisLoader gain higher privileges, although Varonis did not find evidence confirming that the bypass worked during an actual attack.
Another component, hmn_hook.dll, can remove a chosen process from results returned by a Windows system-information function. In practice, this could help conceal a malicious process from some monitoring tools, but researchers could not confirm that it was used to hide AvisLoader.
The web-based AvisLoader Command Center gives attackers a list of infected computers and details such as their location, hardware, antivirus software and administrator status. From the same panel, attackers can send shell commands to selected computers and distribute additional files through the Tox network.
Protection Against ClickFix Attacks
To avoid ClickFix attacks, users should treat any website that asks them to copy and paste a command into Windows Run, PowerShell, Command Prompt or a terminal as malicious. Legitimate document-signing and verification services do not require visitors to run commands on their computers. Close the page without following its instructions and report it to the organization’s security team.
(Photo by Philip Oroni on Unsplash)
