# AvisLoader: Windows Malware Loader with Tox P2P C2, Delivered via DocuSign-Themed ClickFix Lures

> AvisLoader is a Windows malware loader that uses the Tox peer-to-peer messaging network for command and control, so it has no fixed C2 domain to take down. It is delivered through DocuSign-themed ClickFix lures on Cloudflare Workers that make victims paste a command which fetches a payload from a Cloudflare Quick Tunnel (trycloudflare.com) address.

- **Published:** 2026-10-12T14:17:10Z
- **Last reviewed:** 2026-10-12T14:17:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3362
- **ID:** TL-2026-3362
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AvisLoader was discovered by Varonis Threat Labs (researcher Daniel Kelley) on an exposed staging server that held the ClickFix lure, supporting tools and the operator's Command Center. The name comes from the Latin word for bird. The lure page is hosted on Cloudflare Workers and imitates a DocuSign signing request. It shows a fake 'Manual verification' dialog saying 'Verification is handled by Cloudflare' and tells the visitor to paste a 'verification code' into a terminal. The pasted command retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com, which avoids the normal browser download flow and lets the operator rotate disposable, legitimately-hosted infrastructure.

The client, 78324.exe, is a 3.4 MB 64-bit executable with an asInvoker manifest, so it does not request elevation at startup. It statically links the c-toxcore reference implementation, and a build path artifact, C:\Users\dev\Desktop\c-toxcore, is embedded in the binary. C2 runs over Tox, an encrypted peer-to-peer messaging network. The controller can move to another host by copying its Tox save file, and clients follow the same identity without any domain or IP dependency. That makes domain and IP takedowns and sinkholing ineffective against the C2 channel.

Persistence targets desktop and taskbar-pinned shortcuts. The loader modifies the shortcuts, keeps .backup copies of the originals, and uses a VBScript launcher named 'VLCAssistant'. When the user opens a modified shortcut, the malware runs first and then the intended application starts. A helper, auto.exe, implements UAC bypass based on method 41 of UACME, abusing the ICMLuaUtil COM interface and COM elevation mechanism (CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). The tool itself warns that updated Windows versions may mitigate the bypass. hmn_hook.dll exports HMN_HideStart, HMN_HideStatus and HMN_HideStop and hooks NtQuerySystemInformation to filter chosen process names out of results, hiding processes from monitoring tools.

The Command Center dashboard shows total, online and offline client counts. Its clients table lists hostname, country, CPU, GPU, antivirus status, administrator access and public key. The Tasks tab configures shell command tasks and can target clients by hardware, location or admin status. The Files tab stages payloads for delivery to clients over Tox. The source states no CVE, CVSS score, threat actor attribution or network IOCs (no concrete trycloudflare.com subdomain, workers.dev hostname or Tox ID was published). Severity is an analyst assessment. The analysis comes from one vendor (Varonis); BleepingComputer republished it as sponsored content.

## MITRE ATT&CK

- T1583.006 Web Services
- T1204.004 Malicious Copy and Paste
- T1059.005 Visual Basic
- T1547.009 Shortcut Modification
- T1548.002 Bypass User Account Control
- T1014 Rootkit
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1518.001 Security Software Discovery

## Sources

- [Meet AvisLoader: A Windows Loader Built to Outlast a Takedown (Varonis Threat Labs)](https://www.varonis.com/blog/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown)
- [Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption (BleepingComputer, sponsored content)](https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/)
- [Meet AvisLoader: A Windows Loader Built to Outlast a Takedown (HackerNoon repost)](https://hackernoon.com/meet-avisloader-a-windows-loader-built-to-outlast-a-takedown)
- [New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2 (Hackread)](https://hackread.com/avisloader-windows-malware-clickfix-tox-p2p-c2/)
- [SOC Prime detection content: AvisLoader (German-language post)](https://socprime.com/?p=53188)
- [SOC Prime detection content: AvisLoader](https://socprime.com/?p=53305)
- [UACME: Defeating Windows User Account Control (method 41, ICMLuaUtil)](https://github.com/hfiref0x/UACME)
- [c-toxcore: reference implementation of the Tox protocol](https://github.com/TokTok/c-toxcore)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3362