AvisLoader (Varonis 23 Sep): Windows ClickFix DocuSign lure; Tox P2P C2 built to survive takedowns
Varonis Threat Labs (published 23 September 2026) documents AvisLoader, a Windows malware loader discovered on an exposed staging server with lure pages, supporting files and an operator dashboard. Initial access mirrors ClickFix: a fake DocuSign/document-signing verification page instructs the visitor to paste and run a command that retrieves code via a temporary Cloudflare tunnel rather than a normal browser download. Persistence/control deliberately avoids a fixed C2 domain — the Windows executable embeds the Tox peer-to-peer messenger so operators can move the controller by copying a Tox save file while clients follow the same operator identity. Dashboard lists clients, device details, security software and admin status; task controls can queue shell commands and a file area offers further Tox payload delivery. Sample observed: ~3.4 MB 64-bit executable starting with the launching user's privileges; helpers reference a known Windows privilege-bypass method and process-hiding library (capabilities recovered from tooling, not confirmed victim deployment). Advertised for sale on a cybercrime forum. No victim count published; researchers did not observe a successful takedown-and-recovery cycle. No CVE. Primary: Varonis; wire: Cyber Security News 24 Sep 2026.
- Product
- AvisLoader Windows malware loader (ClickFix DocuSign-themed lure; Tox P2P C2; Cloudflare tunnel stage)
- Versions
- n/a (malicious loader; ~3.4 MB 64-bit Windows sample per Varonis; no CVE)
- Exploited in Australia?
- unknown
- Patch to
- Treat unexpected DocuSign/verification Run-dialog prompts as hostile; block/hunt Cloudflare-tunnel staging fetches paired with Tox traffic; restrict msiexec/curl/powershell paste-execution via ASR/AppLocker where feasible; hunt for shortcut rewrite / process-hiding helpers on endpoints that hit the lure
Primary: Varonis Threat Labs — Meet AvisLoader (23 Sep 2026) · Vendor: Varonis — AvisLoader Windows loader analysis · Cyber Security News — AvisLoader Tox P2P loader (24 Sep 2026)