AvisLoader Malware Uses Tox for Command Delivery via ClickFix Lure

• •AvisLoader uses Tox for resilient command delivery, complicating takedowns.
• •The malware is delivered via a ClickFix lure masquerading as a DocuSign request.
• •Its structure includes misleading packer names to evade detection.

AvisLoader is a newly discovered Windows malware loader that utilizes the Tox peer-to-peer network for command and payload delivery. It is delivered through a ClickFix lure disguised as a DocuSign verification prompt, tricking users into executing a command. The malware operates without a fixed server, making it difficult for defenders to disrupt. The loader is a 3.4 MB executable that inherits privileges from the launching process, and its structure includes misleading names associated with well-known packers. The malware's persistence mechanism and command-and-control capabilities allow it to manage infected systems effectively. Security teams are advised to monitor for specific indicators of compromise related to this threat.