GoKawiilVaronis finds AvisLoader malware using Tox P2P network to evade takedowns
Varonis Threat Labs discovered AvisLoader, a new Windows malware loader found on an exposed staging server alongside a ClickFix phishing lure and its control panel. The malware is delivered via a fake DocuSign verification page hosted on Cloudflare Workers that tricks victims into pasting and running a malicious command, which then fetches code from a Cloudflare Quick Tunnel address.
GoKawiil's interpretation of the reporting above, not reported fact.
By using Tox, an encrypted peer-to-peer messaging network, for command-and-control instead of a fixed domain, operators can reportedly relocate their infrastructure just by copying a save file, which could make domain-based takedowns far less effective. A forum seller's claim that clients automatically follow the controller to a new server suggests the malware is being marketed specifically on this resilience, potentially extending its operational lifespan against defenders.
- AvisLoader is a newly identified Windows malware loader found by Varonis Threat Labs.
- It uses the Tox P2P messaging network for command-and-control, reducing reliance on fixed domains.
- Delivery relies on a ClickFix-style fake DocuSign verification page hosted via Cloudflare Workers and Quick Tunnel.
Source: bleepingcomputer.com, 2026-10-12
Published there as: “Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.