- Varonis Threat Labs found AvisLoader, a Windows loader that takes commands over the encrypted Tox peer-to-peer network, with no fixed domain or server address.
- Domain takedowns are harder, yet Varonis says the connections remain observable alongside the loader's activity on the device.
- Teams should watch for pasted-command execution, unexpected Tox traffic and modified shortcuts, and train staff to report pages asking them to paste commands.
Defenders have a familiar move against malware: take away its address. Block the domain or seize the server, and infected machines stop getting orders. Varonis Threat Labs says a new Windows loader, AvisLoader, is built to blunt that move.
The researchers found it on an exposed staging server. Next to it sat a fake-verification page, supporting tools and the operator's control panel. The lesson is this: when malware has no single address to remove, the useful handle is what it does on the device.
The employee runs the first step
The attack opens with a technique called ClickFix. A web page asks the visitor to copy a command and run it on their own computer. Here the page posed as a DocuSign signing request and sat on Cloudflare Workers.
A fake "Manual verification" box said "Verification is handled by Cloudflare". It told the visitor to paste a "verification code" into a terminal. In fact, the "code" was a command.
Once pasted, the command calls out to a trycloudflare.com tunnel, pulls down code and starts it. Varonis says a download still happens. But it runs through the pasted command, not the browser's usual download path. So controls that watch browser downloads have less to inspect.
The researchers add one caveat. The lure showed a macOS command, yet the exposed directory held a Windows loader. They found no macOS payload among the recovered files.
How the loader stays connected
AvisLoader is built on Tox, an encrypted peer-to-peer messaging network. The file holds a full copy of c-toxcore, the standard Tox software library. It is compiled in, so nothing extra needs installing. The author also left a trace: a folder path from their own PC, C:\Users\dev\Desktop\c-toxcore.
With Tox, an infected machine joins a network and trades messages with its operator like any other member. No set domain or server address holds that link together. The operator keeps the same identity after moving servers.
A cybercrime forum listing makes a related claim. According to the seller, copying one save file to a new server moves the controller, and infected machines follow without any domain. That is the seller's claim, as reported by Varonis. The report does not say the researchers verified it.
What the tools can do
The file's manifest says asInvoker. That means it takes on the rights of whatever started it. It does not trigger a Windows elevation prompt at launch.
Its section table lists seventeen extra sections, all the same size. Their labels echo well-known packing tools: Themida, VMProtect, Enigma and UPX. None is marked executable. Varonis says the labels look meant to confuse packer identification. They do not prove any of those tools was used.
To stay on a machine, the code targets shortcuts on the desktop and in the taskbar's pinned folder. It holds shortcut-backup strings and a VBScript launcher tied to the name VLCAssistant. The apparent design is simple. A user opens a modified shortcut, the malware starts, and then the real application opens so nothing looks wrong.
Two recovered helpers add more. The first, auto.exe, references method 41 from UACME, a public collection of User Account Control bypasses. Its own text warns that updated Windows may block the bypass. So its presence does not show that elevation worked.
The second, hmn_hook.dll, hooks NtQuerySystemInformation, a Windows function that lists running processes. It filters one named process out of the results. Varonis says the files do not show it was used to hide AvisLoader itself.
A control panel built for planning ahead
The operator's web dashboard is called the AvisLoader Command Center. Its main page shows a world map and counts of all, online and offline machines.
A Clients table logs each machine's hostname, country, processor, graphics card, antivirus product, administrator status and a public key. The key fits Tox's peer identity model.
The Tasks tab lets operators pick machines by hardware, location and administrator status. Tasks can run when a matching machine comes online. So commands can be ready before it connects. The Files tab stages more payloads, described as delivery "to clients over Tox".
Watch the behavior, not just the address
Think of a takedown as cutting a phone line. It works when there is one line. A peer-to-peer design leaves no single line to cut. The call can resume from elsewhere under the same identity.
Varonis does not say the traffic is invisible. It says the network connections remain observable alongside the loader's activity on the host. A legitimate messaging protocol can carry operator commands and more malware. So teams must ask what the application behind the traffic is doing.
Questions to put to your security team
First, can we see a command shell or script tool that fetches and runs remote code soon after a user visits a suspicious page? A pasted command may run without the browser as its parent process.
Second, does our monitoring flag a desktop that starts talking over Tox or another peer-to-peer channel it has no business using?
Third, can we hunt for modified desktop and taskbar shortcuts, .backup files and references to VLCAssistant? Can we also search for files matching the two recovered samples, auto.exe and hmn_hook.dll?
Fourth, have we told employees to escalate any web page that tells them to run clipboard text in a command window or the Windows Run box? Varonis recommends regarding such pages with suspicion. It also suggests reviewing unfamiliar workers.dev and trycloudflare.com addresses. Both serve legitimate uses too, so judge each in context.
A takedown needs a target. Detection needs only a behavior. For this loader, that is where defenders have something to work with.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: BleepingComputer.
