Researchers at Varonis Threat Labs have identified a new Windows loader called AvisLoader, found on an exposed staging server along with a ClickFix lure, supporting tools, and its control panel. What sets the AvisLoader malware apart is how it keeps in touch with its operators: instead of a traditional server address, it uses Tox, an encrypted peer-to-peer messaging network, making the usual domain-based takedown approach much harder to pull off.
How does the AvisLoader malware trick people into running it?
The infection starts with a familiar ClickFix-style lure: a fake page disguised as a DocuSign signing request, hosted on Cloudflare Workers. A bogus “Manual verification” pop-up tells visitors that “Verification is handled by Cloudflare” and asks them to paste a code into a terminal to view the document. That pasted command actually fetches and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com, downloading the payload outside the browser’s normal download process. Although the lure displays a macOS-style command, researchers only recovered a Windows payload — no matching Mac version was found.
The Windows executable is a 3.4 MB, 64-bit file that runs with whatever privileges launched it, without triggering a Windows UAC prompt. It’s built on c-toxcore, the reference library for the Tox protocol, which is what lets it act as just another peer on the network rather than phoning home to a fixed address. The seller behind AvisLoader reportedly markets this on a cybercrime forum, claiming operators can move their control server just by copying a Tox save file — no domain needed.
What else did researchers find alongside the loader?
The recovered files include a shortcut-hijacking persistence trick, a small UAC-bypass helper referencing a public technique called UACME, and a separate DLL designed to hide processes from tools that rely on Windows’ NtQuerySystemInformation function. The malware’s “Command Center” panel lets operators track online and offline clients by hostname, country, hardware, and antivirus software, and lets them schedule shell commands or push files to victims over Tox.
For U.S. security teams, this is a reminder that network-based defenses need to watch for unusual peer-to-peer traffic, not just suspicious domains. In a related development, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks covered how attackers are finding other creative ways around standard defenses, and NovaCookies Phishing Toolkit Exploits DocuSign to Hijack Microsoft 365 Sessions showed a similar pattern of abusing trusted services like DocuSign to lower victims’ guard.
المصدر: BleepingComputer
