Researchers found it on an exposed staging server alongside a fake document-signing page, supporting tools, and an operator dashboard.
Because its command channel does not rely on one fixed domain, taking down a malicious website may not disconnect infected devices.
The attack begins with a ClickFix lure hosted on Cloudflare Workers. The page imitates a DocuSign request and displays a “Manual verification” prompt that claims to be handled by Cloudflare.
Instead of completing a normal verification, visitors are told to paste a supposed code into a terminal. That clipboard content is a command that retrieves and runs code from a Cloudflare Quick Tunnel address on trycloudflare.com.
AvisLoader Uses Tox for Resilient C2
The browser does not need to download a file directly: the user runs the command outside it. Investigators noted a mismatch in the recovered material.
The lure displayed a macOS command, but the exposed directory contained a Windows loader; they found no matching macOS payload.
The evidence links the lure and loader on the staging server, but does not establish that this exact command delivered the recovered Windows sample.
The Windows sample, named 78324.exe, is a 3.4 MB, 64-bit executable. It includes c-toxcore, the Tox protocol implementation, allowing it to communicate with its controller as a peer.
A cybercrime forum listing claimed operators could move the controller to another server by copying its Tox save file, keeping the same identity without requiring clients to follow a new domain. That makes domain-based disruption harder, although network activity and behavior on the infected device remain visible.
The loader contains code associated with modifying desktop and taskbar shortcuts. Strings referring to shortcut backups and a VBScript launcher named VLCAssistant suggest that opening a modified shortcut could start the malware before launching the intended application.
The recovered files also included auto.exe, a helper referencing UACME method 41, and hmn_hook.dll, a library able to filter a process name from information returned by NtQuerySystemInformation. Researchers did not confirm that privilege escalation succeeded or that the DLL was deployed to hide AvisLoader.
The exposed AvisLoader Command Center shows controls for viewing client details, scheduling shell commands, selecting targets by hardware, location or administrator status, and staging files for delivery over Tox. These controls show intended capabilities, not proof that every task or transfer occurred, varonis said.
Security teams should investigate document or verification pages that instruct users to run commands, especially when the command retrieves remote code.
Modified desktop or taskbar shortcuts, related .backup files, VLCAssistant references, and unexpected Tox traffic can provide further leads. Cloudflare Workers and Quick Tunnel also have legitimate uses, so their domains alone are not evidence of infection.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
