Science & Tech · Cybersecurity · 3 hrs ago
AvisLoader Windows malware uses encrypted peer-to-peer messaging
Security researchers found AvisLoader, a new malware loader for Windows, on an exposed staging server.
The files included a fake document-signing page that asked visitors to paste an attacker-provided command into a terminal.
The recovered malware was a Windows program, though the page showed a command for macOS and researchers found no matching macOS payload.
AvisLoader uses Tox, an encrypted peer-to-peer messaging network, to receive commands and additional software from its operators.
Because it does not rely on one fixed domain or server address, taking down a particular domain may not cut off the operators.
The files also point to ways the malware may alter shortcuts to launch itself, but the recovered evidence does not establish that its attempted privilege bypass would work on updated Windows versions.
Varonis Threat Labs discovered AvisLoader, a new Windows malware loader, on an exposed staging server.
The loader uses the encrypted Tox peer-to-peer network to receive commands and additional payloads from its operator.
Researchers found a ClickFix lure on Cloudflare Workers that posed as a DocuSign document-signing request.
The recovered Windows payload is a 3.4 MB 64-bit executable.
The recovered files also contained tools associated with persistence, a possible UAC bypass and process hiding.
- Who
- Varonis Threat Labs discovered AvisLoader; its operator uses Tox to communicate with it.
- What
- AvisLoader is a Windows malware loader that uses encrypted peer-to-peer messaging to receive commands and additional payloads.
- When
- BleepingComputer published its report on 2026-10-12; the discovery date is not stated.
- Where
- Researchers found it on an exposed staging server. The ClickFix lure was hosted on Cloudflare Workers.
- Why
- The loader’s Tox-based communication avoids reliance on a fixed domain or server address, making traditional domain-based takedowns harder.
This story does not have two clearly opposing sides.
Verification is handled by Cloudflare
verification code
This story does not have a timeline yet.
- Discoverer
- Varonis Threat Labs
- Communication network
- Tox, an encrypted peer-to-peer messaging network
- Windows payload size
- 3.4 MB
- Payload architecture
- 64-bit executable
- Lure hosting service
- Cloudflare Workers
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Critical SonicWall flaw faces exploitation days after patch
Canadian cybersecurity executive arrested on federal extortion charges
Exposure management shifts cybersecurity focus from controls to risk
Ledger confirms a tampered wallet device in crypto theft investigation
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Younger people are more likely than older adults to fall for scams, study finds
Yandex outage did not show a broad drop in Russian bot activity
ShyGlass blurs Mac screens when users turn their heads
Deepfakes can undermine biometric identity checks
