New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2
A new Windows malware loader called AvisLoader is using an encrypted peer-to-peer (P2P) messaging network to communicate with its operators, making it harder to disrupt through traditional domain takedowns.
Cybersecurity researchers at Varonis Threat Labs discovered AvisLoader on an exposed staging server alongside a ClickFix lure, supporting tools, and a web-based command center. They named it after the Latin word for bird.
According to Varonis researcher Daniel Kelley, AvisLoader uses Tox, a peer-to-peer messaging network that does not rely on a fixed command-and-control domain or server address.
Social Engineering and Execution Mechanics
Varonis’ research blog shared with Hackread.com reveals that the infection chain begins with a ClickFix lure designed to trick users into running an attacker-supplied command. The attack chain begins when targets visit a web page hosted on Cloudflare Workers. This page is disguised as a DocuSignsignature request and displays a prompt claiming that...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
