AvisLoader Windows Malware Uses ClickFix Lures and Tox P2P C2 to Resist Takedowns

Two notes before the details. First, the BleepingComputer version of this research is a sponsored post written by Varonis. Varonis Threat Labs first published the research, credited to senior security researcher Daniel Kelley, on its own blog, and that page was last updated September 23, 2026. The original post also includes a full indicator-of-compromise list and a MITRE ATT&CK mapping that the sponsored version leaves out. Both are reproduced below. Second, Cyber Security News, which also received the Varonis report, noted that the discovery shows a route for lasting remote access, not a measured outbreak. Researchers did not report victim numbers. So treat this as a threat to prepare for, not a confirmed outbreak.

How Researchers Found It​

According to Varonis, the loader is named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center. An exposed staging server gave researchers a rare look at the whole kit: the lure, the Windows client, two helper tools and the operator's web panel.

Varonis also found AvisLoader advertised for sale on a cybercrime forum. The seller claims the controller can be moved to a new server by copying its Tox save file, and that infected clients follow it without needing a domain. That claim comes from the seller. It is not independent proof that every deployment works that way. Still, it shows the selling point: if a takedown hits, the operator moves and carries on.

Section summary: AvisLoader is a Windows loader sold on a crime forum. It was found with its full toolkit on a misconfigured server, and its main selling point is a C2 channel that doesn't depend on a domain.

The Lure: A Fake DocuSign Page Asking You to Paste a Command​

The infection starts with ClickFix, which has become a common social-engineering technique. The attack chain begins when targets visit a web page hosted on Cloudflare Workers. This page is disguised as a DocuSign signature request and displays a prompt claiming that "Verification is handled by Cloudflare."

A fake "Manual verification" box then tells the visitor to paste a "verification code" into a terminal to open the document. What actually goes onto the clipboard is a command that downloads and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com. A download still happens, but the pasted command does it, so it never goes through the browser's normal download process.

This is why ClickFix keeps working. Browser download warnings and attachment scanning are built for files arriving through the usual routes. Here the user runs the command themselves, so the download happens after the browser is out of the picture.

There's an odd detail. Although the lure displayed a macOS command, the exposed directory contained a Windows loader. Varonis did not find a corresponding macOS payload among the recovered files. The evidence does not show a cross-platform AvisLoader campaign. The safest reading is a reused or mismatched lure sitting next to a Windows payload. On Windows, the same trick usually means pasting into the Run dialog or a terminal, and Varonis's defensive advice covers both.

Section summary: The way in is social engineering, not an exploit. Any "verification" step that asks you to paste a command is the warning sign.

Inside the Loader​

The Windows client, a file named 78324.exe in the recovered set, has a few notable features:

• Size and architecture: It is a single 3.4 MB, 64-bit executable.
• No elevation prompt: Its manifest specifies asInvoker. That means it runs with the same privileges as whatever launched it and does not ask for a UAC prompt at startup. Run from a standard user session, it starts as a standard user.
• Fake packer sections: The file has seventeen extra sections of identical size, named after well-known packers including Themida, VMProtect, Enigma and UPX. None of them is marked executable. Varonis says the names appear meant to confuse packer identification, but the names alone don't prove any of those packers was used. It's like putting a "Beware of Dog" sign on an empty yard.
• Underneath, it's a Tox client: The executable statically links c-toxcore, the reference implementation of the Tox protocol. It also still contains the developer's build path, C:\Users\dev\Desktop\c-toxcore, which defenders can hunt for.

Because the loader talks to its controller as just another Tox peer, there's no single C2 address to block. Varonis stresses that this does not make it invisible: the network connections can still be seen alongside what the loader does on the host.

Escalation, Persistence and Stealth Tools​

The recovered files point to three more capabilities. In each case, Varonis is careful to say what it could confirm and what it couldn't.

Shortcut hijacking for persistence. The persistence code targets shortcuts on the desktop and in the taskbar-pinned folder. The executable contains shortcut-backup strings, a .backup extension and a VBScript launcher associated with the name VLCAssistant. Together these suggest a setup where opening a modified shortcut launches the malware and then the real application, so nothing looks wrong. Picture clicking your browser icon: the browser opens as usual, and the loader starts quietly in the background. Varonis maps this to shortcut modification but notes that boot or logon execution was not established.

A UAC bypass helper. A small tool called auto.exe references method 41 from UACME, a public UAC-bypass project. Its strings name the ICMLuaUtil interface and the COM elevation mechanism that technique uses. The helper itself warns that updated Windows versions may block the bypass. Varonis says plainly that its presence does not prove elevation succeeded.

A process-hiding DLL. hmn_hook.dll hooks NtQuerySystemInformation, the Windows function programs use to list running processes, and removes a chosen process name from the results. That could hide a process from any tool that relies on the hooked function. However, the recovered files don't show the DLL being loaded into Task Manager or used to hide AvisLoader itself.

This is how threat research should be written. Many malware write-ups describe every string found in a binary as a confirmed capability. Varonis keeps "what the code could do" separate from "what we saw it do."

Section summary: Shortcut hijacking, a UAC bypass that newer Windows builds may block, and a rootkit-style process filter were all present in the kit. None of them was confirmed working on a victim machine.

The AvisLoader Command Center​

The operator panel shows how a buyer would use the loader day to day:

Being able to filter by GPU and admin status matters. It suggests buyers could sort victims by value, for example sending one payload to powerful machines and another to admin-level hosts. That last point is our reading, not a Varonis finding. Varonis also notes that successful file transfers were not confirmed.

Indicators of Compromise​

These indicators come from the IOC list in Varonis's original research post.

Host and analysis artifacts to hunt for:

• Launcher name: VLCAssistant
• Shortcut backup extension: .backup, when found next to modified desktop or taskbar shortcuts
• Embedded build path: C:\Users\dev\Desktop\c-toxcore
• hmn_hook.dll exports: HMN_HideStart, HMN_HideStatus, HMN_HideStop
• COM class identifier referenced by auto.exe: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}

Varonis's MITRE ATT&CK mapping: T1204.004 (User Execution: Malicious Copy and Paste), T1547.009 (Shortcut Modification), T1548.002 (Bypass User Account Control), T1014 (Rootkit), T1071 (Application Layer Protocol) and T1105 (Ingress Tool Transfer).

Filenames are easy to change and hashes go stale fast. Treat a match as a reason to investigate, not proof of infection, and treat a miss as no guarantee you're clean.

What Windows Admins and Users Should Do​

Based on Varonis's recommendations:

1. Train users on the paste-a-command trick. Any document-signing or "verification" page that asks you to paste something into a terminal or the Windows Run dialog should be treated as hostile and reported before anything is run. Legitimate CAPTCHAs don't need PowerShell.
2. Check Cloudflare-hosted addresses in context. Look into unfamiliar workers.dev and trycloudflare.com addresses when they show up in signing lures or download-and-execute commands. Both host plenty of legitimate services, so blocking them outright may break things. Weigh the page content and the surrounding activity.
3. Watch for shells that download and run remote code. Command shells or script interpreters fetching and executing code right after a visit to a suspicious page are a strong signal. Note that a user-pasted command may not show the browser as its parent process, so detection rules based on parent processes can miss it.
4. Look for unexpected Tox or P2P traffic on the same machine. Few corporate workstations have a legitimate reason to run Tox.
5. Hunt for shortcut tampering. Check desktop and taskbar shortcuts for changes, especially with matching .backup files or VLCAssistant references nearby. Then look at surrounding activity for elevation attempts or process-list hooks. In Windows, taskbar pins are usually stored under the user's AppData folder in the "User Pinned\TaskBar" path, so comparing shortcut targets there against expected application paths is a quick manual check. This tip is general Windows knowledge, not part of the Varonis findings.
6. Check suspicious files by hash. PowerShell's Get-FileHash uses SHA-256 by default, so you can compare a suspicious file directly against the table above.

For home users the advice is shorter: if a website asks you to press Win+R and paste something, close the tab.

The Bigger Picture​

AvisLoader doesn't introduce any new technique. ClickFix, shortcut hijacking, UACME bypasses and API-hooking rootkits are all well known. What's notable is the packaging: a ready-to-sell kit with a polished panel and a C2 channel built so that a takedown doesn't cut the operator off. SOC Prime's summary of the research describes that decentralized design as letting operators maintain connectivity and relocate controllers without depending on fixed domains or centralized servers.

For defenders, the lesson is to rely on endpoint behavior and process lineage rather than domain blocklists. Shortcut tampering, odd process lineage and unexpected P2P traffic can all be detected regardless of how resilient the C2 is. One caveat about the source: it's vendor research published as sponsored content, and the original post ends by pitching Varonis's own platform. The technical findings are carefully qualified and match independent coverage, but the claim that only behavioral analytics can catch this is a sales message. Microsoft Defender, a good EDR or a well-tuned SIEM can follow the same detection logic.

Bottom Line​

• Varonis Threat Labs recovered AvisLoader, its ClickFix lure, helper tools and its Command Center from an exposed staging server.
• The loader uses Tox peer-to-peer messaging for C2, which makes domain takedowns far less effective. It does not hide its network traffic.
• Shortcut persistence, a UACME method 41 UAC bypass and a process-hiding DLL were all in the kit, but none was confirmed working on a victim system.
• No victim numbers have been reported. The kit is a capability on offer, not a measured campaign.
• Your best defenses are user training against paste-a-command lures, monitoring of shells and script interpreters, shortcut-tampering hunts and watching for P2P traffic.