Varonis found a new Windows loader called AvisLoader on an exposed staging server, alongside a ClickFix lure and supporting tools, that uses encrypted Tox peer-to-peer messaging for command and control. The loader was also tied to shortcut-based persistence and remote command execution.
Because its control traffic rides the Tox network instead of a fixed domain or server, the operator can keep the same identity while moving infrastructure elsewhere. That makes ordinary domain takedowns and sinkholing less effective: the server can change, but the command channel can still follow the operator.
For defenders, the important distinction is that the resilience sits in both the host artifacts and the operator identity, not just in the backend host. If your disruption playbook assumes one domain or one server is the control plane, AvisLoader shows a setup that can survive that kind of cleanup.
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt.