AvisLoader: New Windows Malware Loader Uses Tox P2P Network to Resist Takedowns

Varonis Threat Labs discovered AvisLoader, a Windows loader distributed via a fake DocuSign-style ClickFix lure hosted on Cloudflare Workers. Instead of a fixed C2 domain, it communicates over the encrypted Tox peer-to-peer network, making domain-based takedowns harder. The toolkit includes a Command Center panel, a UACME-based UAC bypass, and a DLL for process hiding.

• Distributed via a ClickFix lure posing as a DocuSign signing request on Cloudflare Workers
• C2 runs over the Tox P2P network with no fixed domain or server address
• Bundled with UACME method 41 UAC bypass and hmn_hook.dll for process hiding
• Command Center panel shows clients, tasks and files with a world map