Threat reportMalwareTL-2026-3362
AvisLoader: Windows Malware Loader with Tox P2P C2, Delivered via DocuSign-Themed ClickFix Lures
AvisLoader: Windows Malware Loader with Tox P2P C2 (TL-2026-3362), also tracked as AvisLoader, is a high-severity malware campaign, first published 2026-10-12. It has no confirmed attribution, affects Microsoft Windows, maps to 12 MITRE ATT&CK techniques (T1014, T1027, T1059), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3362
- Threat ID
- TL-2026-3362
- Also known as
- AvisLoader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in AvisLoader: Windows Malware Loader with Tox P2P C2
Malware and tooling: AvisLoader, UACMe, Tox, UACME, c-toxcore
How AvisLoader: Windows Malware Loader with Tox P2P C2 works
AvisLoader is a Windows malware loader that uses the Tox peer-to-peer messaging network for command and control, so it has no fixed C2 domain to take down. It is delivered through DocuSign-themed ClickFix lures on Cloudflare Workers that make victims paste a command which fetches a payload from a Cloudflare Quick Tunnel (trycloudflare.com) address.
AvisLoader was discovered by Varonis Threat Labs (researcher Daniel Kelley) on an exposed staging server that held the ClickFix lure, supporting tools and the operator's Command Center. The name comes from the Latin word for bird. The lure page is hosted on Cloudflare Workers and imitates a DocuSign signing request. It shows a fake 'Manual verification' dialog saying 'Verification is handled by Cloudflare' and tells the visitor to paste a 'verification code' into a terminal. The pasted command retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com, which avoids the normal browser download flow and lets the operator rotate disposable, legitimately-hosted infrastructure.
The client, 78324.exe, is a 3.4 MB 64-bit executable with an asInvoker manifest, so it does not request elevation at startup. It statically links the c-toxcore reference implementation, and a build path artifact, C:\Users\dev\Desktop\c-toxcore, is embedded in the binary. C2 runs over Tox, an encrypted peer-to-peer messaging network. The controller can move to another host by copying its Tox save file, and clients follow the same identity without any domain or IP dependency. That makes domain and IP takedowns and sinkholing ineffective against the C2 channel.
Persistence targets desktop and taskbar-pinned shortcuts. The loader modifies the shortcuts, keeps .backup copies of the originals, and uses a VBScript launcher named 'VLCAssistant'. When the user opens a modified shortcut, the malware runs first and then the intended application starts. A helper, auto.exe, implements UAC bypass based on method 41 of UACME, abusing the ICMLuaUtil COM interface and COM elevation mechanism (CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). The tool itself warns that updated Windows versions may mitigate the bypass. hmn_hook.dll exports HMN_HideStart, HMN_HideStatus and HMN_HideStop and hooks NtQuerySystemInformation to filter chosen process names out of results, hiding processes from monitoring tools.
The Command Center dashboard shows total, online and offline client counts. Its clients table lists hostname, country, CPU, GPU, antivirus status, administrator access and public key. The Tasks tab configures shell command tasks and can target clients by hardware, location or admin status. The Files tab stages payloads for delivery to clients over Tox. The source states no CVE, CVSS score, threat actor attribution or network IOCs (no concrete trycloudflare.com subdomain, workers.dev hostname or Tox ID was published). Severity is an analyst assessment. The analysis comes from one vendor (Varonis); BleepingComputer republished it as sponsored content.
MITRE ATT&CK techniques used in TL-2026-3362
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information
Execution
T1059 Command and Scripting Interpreter; T1059.005 Visual Basic; T1204.004 Malicious Copy and Paste
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1518.001 Security Software Discovery
Persistence
T1547.009 Shortcut Modification
Privilege Escalation
T1548.002 Bypass User Account Control
Resource Development
Affected products and versions in AvisLoader: Windows Malware Loader with Tox P2P C2
- Microsoft — Windows
Vulnerable versions: Windows builds where UACME method 41 (ICMLuaUtil COM elevation) still works
Remediation for AvisLoader: Windows Malware Loader with Tox P2P C2
Immediate actions
- Hunt for the three published SHA-256 hashes (78324.exe, auto.exe, hmn_hook.dll) and for numeric-only executable names run from user-writable paths
- Search desktop and taskbar shortcuts for .backup copies and for VLCAssistant VBScript references
- Alert on Run dialog, PowerShell or cmd command lines that reach trycloudflare.com or workers.dev addresses
- Isolate hosts that show NtQuerySystemInformation hooking or hmn_hook.dll loaded into monitoring processes
Workarounds
- Disable the Windows Run dialog (Win+R) via Group Policy for users who do not need it
- Block shortcut modification and untrusted VBScript execution with application control or WDAC/AppLocker
Longer-term hardening
- Restrict or monitor egress to trycloudflare.com and workers.dev where there is no business need
- Detect unexpected Tox protocol traffic (UDP/TCP peer-to-peer) at the network perimeter
- Train users that legitimate document-signing services never ask them to paste commands into a terminal or the Run dialog
- Keep Windows fully patched; the UACME method 41 bypass may be mitigated on updated builds
Timeline of AvisLoader: Windows Malware Loader with Tox P2P C2
- Varonis publishes SHA-256 hashes for 78324.exe, auto.exe and hmn_hook.dll, the COM CLSID, the hmn_hook.dll exports and a Varonis ATT&CK mapping.
- Varonis Threat Labs (Daniel Kelley) publishes 'Meet AvisLoader', describing a loader found on an exposed staging server with a DocuSign-themed ClickFix lure, supporting tools and its Command Center.
- SOC Prime publishes a series of detection rules for AvisLoader covering unexpected P2P traffic, Cloudflare Workers/Quick Tunnel lures, modified shortcuts and .backup files.
- Hackread publishes 'New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2', summarising the 64-bit asInvoker client, the 17 sections named after packers and the Cloudflare Workers/Quick Tunnel delivery.
- HackerNoon reposts the Varonis analysis, and SOC Prime publishes detection content for AvisLoader.
- Threadlinqs opens TL-2026-3362 to track AvisLoader's resilience TTPs (Tox P2P C2, ClickFix lures, Quick Tunnel hosting) for detection content.
- BleepingComputer publishes the Varonis analysis as sponsored content under 'Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption'.
Sources cited for AvisLoader: Windows Malware Loader with Tox P2P C2
- Meet AvisLoader: A Windows Loader Built to Outlast a Takedown (Varonis Threat Labs)
- Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption (BleepingComputer, sponsored content)
- Meet AvisLoader: A Windows Loader Built to Outlast a Takedown (HackerNoon repost)
- New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2 (Hackread)
- SOC Prime detection content: AvisLoader (German-language post)
- SOC Prime detection content: AvisLoader
- UACME: Defeating Windows User Account Control (method 41, ICMLuaUtil)
- c-toxcore: reference implementation of the Tox protocol
- MITRE ATT&CK T1204.004 Malicious Copy and Paste
Detection coverage for TL-2026-3362
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3362 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.