AvisLoader Windows loader with ClickFix delivery and Tox C2
Malware Activity
Summary
Hide ▲
Show ▼
AvisLoader is a newly identified Windows loader that uses a ClickFix lure and Tox-based command-and-control to deliver commands and payloads, increasing the difficulty of disruption and tracking. Varonis Threat Labs found it on an exposed staging server with supporting tools and a Command Center. The recovered components point to shortcut persistence, UAC bypass tooling, and a process-hiding DLL. The operator setup also supports staged file delivery and client tasking over Tox.
Timeline
-
12.10.2026 17:00 2 articles · 3h ago
Varonis Threat Labs discovers AvisLoader on an exposed staging server
Initial DisclosureVaronis Threat Labs discovered AvisLoader, a Windows loader found on an exposed staging server alongside a ClickFix lure, supporting tools, and an AvisLoader Command Center. The lure was hosted on Cloudflare Workers, posed as a DocuSign signing request, and delivered a command that retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com. The recovered loader statically links c-toxcore, uses Tox for encrypted peer-to-peer command-and-control, and includes shortcut-persistence artifacts for desktop and taskbar-pinned folders. The recovered files also include auto.exe tied to UACME method 41 and hmn_hook.dll, which hooks NtQuerySystemInformation to filter process names.
Show sources
- Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption — www.bleepingcomputer.com — 12.10.2026 17:00
- Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption — www.bleepingcomputer.com — 12.10.2026 17:00