Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center.
The attack starts with a familiar ClickFix lure. A page posing as a document-signing request asks visitors to copy and run an attacker-supplied command on their machine.
The more interesting part is how AvisLoader stays connected. It communicates via Tox, an encrypted peer-to-peer (P2P) messaging network that carries commands and additional payloads from the operator.
That setup makes traditional domain-based takedowns harder. The command-and-control (C2) channel does not depend on a fixed domain or server address, and operators can keep the same identity when moving to another server.
The seller references this in a cybercrime forum listing, claiming the controller can be moved by copying its Tox save file, with clients following without the need for a domain.
In this post, we look at how AvisLoader works, the MITRE ATT&CK techniques it uses, and the indicators security teams can use to detect it.
Delivery through ClickFix and Cloudflare
The specific ClickFix lure we found alongside AvisLoader was hosted on Cloudflare Workers and made to look like a DocuSign signing request.
A fake “Manual verification” dialog claims “Verification is handled by Cloudflare” and asks visitors to paste a “verification code” into a terminal. It presents running the command as a step needed to access the document.
What lands on the clipboard is a command that retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com. A download still takes place, but through the pasted command, outside the browser’s normal download flow.
Although the lure shows a macOS command, the exposed directory contained a Windows loader. We did not find a corresponding macOS payload among the recovered files.
Listen to State of Cybercrime, Varonis’ monthly podcast to learn about high-profile cyberattacks, shadow IT, supply chain incidents, and AI security risks.
Subscribe to the series and catch every future episode.
Inside the loader
The Windows payload is a single 3.4 MB 64-bit executable. Its manifest specifies asInvoker, meaning it inherits the privileges of the process that launches it without requesting User Account Control (UAC) elevation at startup.
Its section table contains seventeen additional sections of identical size, with names associated with well-known packers, including Themida, VMProtect, Enigma, and UPX. None is marked executable.
These names appear intended to confuse packer identification, although the names alone do not establish that any of those packers was used.
Underneath, it’s a Tox client. The executable statically links c-toxcore, the reference implementation of the Tox protocol, and retains the developer’s build path, C:UsersdevDesktopc-toxcore.
Using Tox lets the loader communicate with its controller as another peer on the network. This removes reliance on a single centralized command-and-control address, but the network connections remain observable alongside the loader’s activity on the host.
Escalation, persistence, and stealth
AvisLoader’s persistence code targets shortcuts on the desktop and in the taskbar-pinned folder. The executable contains shortcut-backup strings and a VBScript launcher associated with the name VLCAssistant. These artifacts indicate a mechanism designed to launch the malware when a user opens a modified shortcut, then start the intended application so it appears to open normally.
The recovered files also include auto.exe, a small helper that references method 41 from UACME, a public User Account Control (UAC) bypass project. Its strings identify the ICMLuaUtil interface and the Component Object Model (COM) elevation mechanism associated with that technique.
The helper also warns that updated Windows versions may mitigate the bypass, so its presence does not establish successful elevation.
A separate dynamic-link library (DLL), hmn_hook.dll, provides process-hiding functionality. It hooks NtQuerySystemInformation, a Windows function used to retrieve process information, and filters a specified process name from the results. This could hide that process from software using the hooked function, but the recovered files do not establish that the DLL was loaded into Task Manager or used to hide AvisLoader itself.
The AvisLoader command center
The recovered tools give us a view of AvisLoader’s endpoint capabilities. Its web panel, branded the AvisLoader Command Center, shows how operators are meant to manage clients, configure tasks, and distribute files.
The dashboard includes counts of total, online, and offline clients, along with a world map.
A Clients table includes fields for hostname, country, central processing unit (CPU), graphics processing unit (GPU), antivirus, administrator status, and a public key. These fields bring host information into one view. The public-key field is consistent with Tox’s peer identity model.
The Tasks tab lets operators configure shell commands and select clients by hardware, location, and administrator status. Its controls indicate support for tasks that run when matching clients come online, allowing operators to prepare commands ahead of a client connecting.
The Files tab provides an interface for staging files and describes delivery “to clients over Tox.” This gives operators a way to prepare additional payloads for distribution.
Defenses and takeaways
AvisLoader gives security teams several opportunities for detection, from the initial ClickFix command to shortcut changes and unexpected Tox traffic. The delivery setup and recovered files point to four areas for monitoring:
- Treat document-signing or verification pages that ask users to paste commands into a terminal or the Windows Run dialog as suspicious. Users should report these requests before running the command.
- Investigate unfamiliar workers.dev and trycloudflare.com addresses when they appear in document-signing lures or commands that download and execute code. Both domains support legitimate services, so consider the page content and surrounding activity when assessing them.
- Monitor command shells and script interpreters that retrieve and execute remote code, especially when the activity follows a visit to a suspicious page. Check for unexpected Tox or other peer-to-peer traffic on the same device. A command pasted by a user may run without the browser appearing as its parent process.
- Hunt for modified desktop and taskbar shortcuts, associated .backup files, and references to VLCAssistant. Investigate matches for the recovered auto.exe and hmn_hook.dll samples, then examine the surrounding activity for elevation attempts or process-list hooks.
What we learned from AvisLoader
AvisLoader brings familiar malware techniques together around Tox. The recovered Windows sample includes shortcut-persistence artifacts, while its Command Center offers shell tasks and file delivery over an encrypted peer-to-peer connection.
For security teams, this means a legitimate messaging protocol can also carry operator commands and additional malware. Understanding that traffic means looking at the application behind it and what it does on the device, alongside the network connections it makes.
Join Varonis on State of Cybercrime for bite-sized insights on all things data security, threat detection, AI security, and more.
Sponsored and written by Varonis.
