Executive Summary
AvisLoader represents a shift toward highly resilient malware infrastructure by leveraging the Tox protocol, an encrypted peer-to-peer messaging network, for its command-and-control (C2) channel. Discovered by Varonis Threat Labs, this loader avoids reliance on centralized HTTP infrastructure, instead using peer identities that allow operators to migrate control systems without losing connectivity to infected clients.
The malware is primarily delivered through "ClickFix" social engineering campaigns, which trick users into manually executing commands in a terminal under the guise of document verification (e.g., DocuSign or Cloudflare lures). Beyond its primary loader functions, the AvisLoader toolkit includes components for UAC bypass, process hiding via API hooking, and persistence through the modification of Windows shortcut (.lnk) files.
The use of legitimate P2P protocols like Tox and common web services like Cloudflare Quick Tunnels makes disruption difficult for traditional network defenders. While currently targeting Windows, the delivery lures have been observed to include macOS-specific instructions, suggesting potential cross-platform aspirations.