AvisLoader is a newly discovered Windows malware loader that leverages the Tox encrypted peer-to-peer messaging network for its command-and-control communications, rendering traditional domain-based takedown strategies ineffective. Infection begins with a ClickFix social engineering tactic, where victims are deceived into copying and running malicious commands disguised as document verification steps. The loader is distributed via Cloudflare infrastructure and incorporates multiple stealth features such as shortcut modification to maintain persistence, attempts to bypass User Account Control (UAC) using UACME method 41, and process hiding through API hooking. Operators manage infected hosts through a web-based Command Center that facilitates client management, task configuration, and payload distribution over the Tox network. This architecture enables operators to maintain control by simply copying their Tox save file when moving infrastructure, with infected clients automatically following without requiring domain updates.

The malware enables persistent and stealthy control over infected Windows systems, evading traditional domain-based takedown efforts due to its use of the Tox peer-to-peer network for command-and-control. It can bypass UAC protections and hide its processes, increasing the difficulty of detection and removal. The infection vector relies on social engineering, potentially leading to unauthorized execution of malicious commands by victims. The architecture allows operators to maintain long-term control and flexibility in relocating their infrastructure without disrupting infected clients.

No official patch or remediation is indicated for this malware loader. Mitigation should focus on user education to recognize and avoid the ClickFix social engineering technique, restricting execution of untrusted commands, and monitoring for indicators of compromise such as the provided file hashes. Endpoint protection solutions should be updated to detect behaviors associated with UAC bypass, shortcut modification, and API hooking. Network defenses should consider the possibility of Tox peer-to-peer traffic for command-and-control. Since the malware uses Cloudflare infrastructure for delivery, monitoring and filtering suspicious traffic from such sources may help. There is no vendor advisory or patch available; organizations should apply layered detection and prevention controls accordingly.