AvisLoader Malware Evades Detection with Tox P2P Network

Researchers discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for command-and-control (C2) communication. This setup makes traditional domain-based takedowns difficult, as the C2 channel does not rely on a fixed domain or server address. The malware is delivered through a ClickFix lure hosted on Cloudflare Workers, mimicking a document-signing request to trick users into running a malicious command. AvisLoader’s persistence mechanisms include modifying desktop and taskbar shortcuts, and it uses a DLL to hide processes from software like Task Manager.