Security researchers at Varonis Threat Labs identified AvisLoader, a Windows-based loader malware whose name derives from the Latin term for bird. The discovery came from an exposed staging server that also contained a ClickFix phishing lure, ancillary tools, and the malware's control infrastructure.
The infection chain begins with a social engineering tactic familiar to security teams. Victims encounter a webpage mimicking a document-signing workflow that instructs them to execute an operator-controlled command within their terminal or command shell.
What distinguishes AvisLoader is its command-and-control architecture. Rather than relying on traditional domain names or fixed server infrastructure, the malware communicates through Tox, an encrypted peer-to-peer messaging platform. This design choice complicates conventional takedown strategies because the C2 channel operates independently of any specific domain or hosting provider, allowing operators to maintain continuity by transferring their Tox identity to new infrastructure.
The malware's seller promoted this capability in cybercrime forums, emphasizing that controllers can migrate by copying the Tox save file, with infected systems automatically following the operator to new infrastructure without requiring domain reconfiguration.
Delivery via ClickFix and Cloudflare
The specific ClickFix variant discovered alongside AvisLoader ran on Cloudflare Workers infrastructure and spoofed a DocuSign authentication interface. A fraudulent "Manual verification" prompt falsely claimed that "Verification is handled by Cloudflare" and requested users paste a "verification code" into a terminal window, framing execution as a prerequisite for document access.
The clipboard payload contains a command that fetches and executes code from a Cloudflare Quick Tunnel endpoint on trycloudflare.com. This approach bypasses standard browser download mechanisms by executing code through a user-pasted command instead.
Although the phishing page displayed macOS syntax, the exposed directory held only a Windows loader executable. No corresponding macOS payload appeared in the recovered artifacts.
Loader Architecture and Obfuscation
The Windows payload consists of a single 3.4 MB 64-bit executable configured with asInvoker manifest settings, meaning it operates with the privileges of its parent process without triggering User Account Control prompts.
The executable's section table includes seventeen additional sections of uniform size bearing names associated with commercial packers: Themida, VMProtect, Enigma, and UPX. None of these sections carry executable flags. These naming choices appear designed to mislead packer analysis tools, though the names alone do not confirm actual use of those packing solutions.
Beneath the obfuscation layer, AvisLoader functions as a Tox client. The binary statically incorporates c-toxcore, the reference implementation of the Tox protocol, and preserves the developer's build path: C:\Users\dev\Desktop\c-toxcore. This integration allows the loader to communicate with its operator as a peer on the Tox network, eliminating dependence on centralized command infrastructure while maintaining observable network signatures.
Persistence, Privilege Escalation, and Concealment
AvisLoader establishes persistence by targeting desktop shortcuts and taskbar-pinned application links. The executable contains backup strings for shortcuts and a VBScript launcher named VLCAssistant, indicating a mechanism that launches the malware when a user activates a modified shortcut, then starts the legitimate application to maintain normal appearance.
Among the recovered files sits auto.exe, a small utility that references method 41 from UACME, a publicly available User Account Control bypass toolkit. String analysis identifies the ICMLuaUtil interface and the Component Object Model elevation technique associated with that method. The helper includes warnings that newer Windows versions may neutralize this bypass, so its presence does not confirm successful elevation occurred.
A separate component, hmn_hook.dll, implements process-hiding capabilities by hooking NtQuerySystemInformation, a Windows API function that enumerates running processes. The hook filters a specified process name from query results, potentially hiding that process from tools that rely on this function. However, the recovered files do not establish whether this DLL was injected into Task Manager or used to conceal AvisLoader itself.
Command Center Capabilities
The recovered infrastructure reveals operator capabilities through the AvisLoader Command Center web panel, which manages infected systems, task configuration, and payload distribution.
The dashboard displays aggregate statistics for total, online, and offline clients alongside a world map visualization. A Clients table presents columns for hostname, country, CPU specifications, GPU information, antivirus product, administrator privileges, and public key. The public-key field aligns with Tox's peer identity model.
The Tasks interface allows operators to configure shell commands and filter targets by hardware characteristics, geographic location, and privilege level. Controls indicate support for delayed task execution triggered when matching clients establish connectivity, enabling operators to prepare commands in advance.
A Files section provides staging and delivery interfaces, with descriptions indicating payloads transfer "to clients over Tox," giving operators a mechanism to queue additional malware for distribution.
Detection and Monitoring Guidance
AvisLoader presents multiple detection opportunities spanning the initial ClickFix delivery through shortcut modifications and peer-to-peer traffic patterns. Security teams should focus monitoring on four key areas:
- Classify document-signing or verification pages requesting terminal or Windows Run dialog command execution as suspicious. Users should report these requests before running commands.
- Investigate unfamiliar workers.dev and trycloudflare.com addresses appearing in document-signing lures or code-execution commands. Both domains support legitimate services, so evaluate page content and surrounding activity context.
- Monitor command shells and script interpreters executing remote code, particularly following visits to suspicious pages. Identify unexpected Tox or peer-to-peer traffic on the same device. User-pasted commands may execute without the browser as parent process.
- Search for modified desktop and taskbar shortcuts, associated .backup files, and VLCAssistant references. Investigate matches for auto.exe and hmn_hook.dll samples, then examine surrounding activity for elevation attempts or process-list hooks.
Key Takeaways
AvisLoader combines conventional malware techniques around Tox infrastructure. The Windows sample incorporates shortcut-persistence mechanisms, while the Command Center distributes shell tasks and payloads through encrypted peer-to-peer channels.
For defenders, this demonstrates that legitimate messaging protocols can serve as command channels for malware operators. Effective detection requires examining both the application generating traffic and its on-device behavior, alongside the network connections it establishes.