Affected Systems

Windows systems targeted via ClickFix social engineering lures. AvisLoader is a 64-bit Windows executable (3.4 MB) delivered through Cloudflare Workers and Quick Tunnels. No specific Windows version restrictions identified. Affects organizations vulnerable to social engineering attacks, particularly those mimicking DocuSign signing requests.

Exploitation Status

Active campaign observed in the wild. Varonis Threat Labs discovered AvisLoader on an exposed staging server with active ClickFix lures, supporting tools, and command center infrastructure. The malware is advertised for sale on cybercrime forums, indicating broader availability to threat actors.

Business Impact

AvisLoader uses Tox encrypted peer-to-peer messaging for command-and-control, making traditional domain-based takedowns and network blocking ineffective. Operators can relocate C2 infrastructure by copying a Tox save file without requiring domain changes or client reconfiguration. The malware establishes persistence via modified desktop and taskbar shortcuts, includes UAC bypass capabilities (UACME method 41), and can hide processes from detection tools via NtQuerySystemInformation hooking. Remote command execution and file distribution capabilities allow full post-compromise control. Detection requires monitoring for Tox network traffic, shortcut modifications, and specific process behaviors rather than static IOCs.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block Cloudflare Quick Tunnel domains (trycloudflare.com) at web proxy and DNS unless business-required; monitor for clipboard-based PowerShell execution patterns associated with ClickFix campaigns
  • Monitor network traffic for Tox protocol connections (UDP/TCP port 33445 and DHT bootstrap nodes); alert on c-toxcore user-agent strings or Tox public key exchanges from workstations
  • Enable tamper protection on EDR agents and audit modifications to desktop shortcuts (.lnk files) in user profiles and taskbar-pinned folders; alert on VBScript launchers executing from shortcut targets
  • Hunt for processes matching AvisLoader indicators: 3.4 MB 64-bit executables with 17 identically-sized sections named after packers (Themida, VMProtect, Enigma, UPX), build path 'C:\Users\dev\Desktop\c-toxcore', or DLLs hooking NtQuerySystemInformation
  • Implement application control policies to block execution of unsigned executables from user-writable directories; restrict PowerShell execution to signed scripts in constrained language mode where feasible