New AvisLoader uses Tox to keep Windows malware commands flowing

Feeds.4Sysops •IT News • October 12, 2026

AvisLoader, a newly uncovered Windows malware loader, uses the encrypted Tox peer-to-peer network for operator commands and payload delivery, reducing its reliance on a fixed server or domain that defenders could take down. It arrives through a ClickFix lure disguised as a DocuSign verification prompt, which tricks visitors into running a command. Recovered files also reveal shortcut-based persistence and a control panel for managing infected systems. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AvisLoader Malware Uses Tox for Command Delivery via ClickFix Lure AvisLoader is a newly discovered Windows malware loader that utilizes the Tox peer-to-peer network for command and payload delivery. It is delivered through a ClickFix lure disguised as a DocuSign verification prompt, tricking users into executing a command. The malware operates without a fixed server, making it difficult for defenders to disrupt. The loader is a 3.4 MB executable that inherits privileges from the launching process, and its structure includes misleading names associated with well-known packers. The malware's persistence mechanism and command-and-control capabilities allow it to manage infected systems effectively. Security teams are advised to monitor for specific indicators of compromise related to this threat. 2 sources 40

Extracted Entities

New AvisLoader uses Tox to keep Windows malware commands flowing

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)