Malware

AvisLoader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

From the same panel, attackers can send shell commands to selected computers. | The page then asks the visitor to paste a code into a terminal... When executed, the command retrieves and runs code outside the browser's normal download process.

T1204User ExecutionEvidence1

The infection chain begins with a ClickFix lure designed to trick users into running an attacker-supplied command... asks the visitor to paste a code into a terminal.

T1204.004Malicious Copy and PasteEvidence1

The ClickFix lure instructs visitors to paste and run an attacker-supplied command.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence2

AvisLoader is designed to remain active by modifying shortcuts on the desktop and taskbar. When a victim opens an affected shortcut, the malware can run first and then launch the expected application.

Privilege Escalation

2 techniques

T1547.009Shortcut ModificationEvidence2

T1548.002Bypass User Account ControlEvidence2

The malware package also contained auto.exe, a program linked to a publicly documented Windows UAC bypass known as UACME method 41.

Stealth

3 techniques

T1014RootkitEvidence1

A separate dynamic-link library (DLL), hmn_hook.dll, provides process-hiding functionality. It hooks NtQuerySystemInformation ... and filters a specified process name from the results.

T1036MasqueradingEvidence1

This page is disguised as a DocuSign signature request and displays a prompt claiming that 'Verification is handled by Cloudflare.'

T1564.001Hidden Files and DirectoriesEvidence1

hmn_hook.dll can remove a chosen process from results returned by a Windows system-information function.

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

The web-based AvisLoader Command Center gives attackers a list of infected computers and details such as their location, hardware, antivirus software and administrator status.

T1518.001Security Software DiscoveryEvidence1

The web-based AvisLoader Command Center gives attackers... details such as their location, hardware, antivirus software and administrator status.

T1614System Location DiscoveryEvidence1

The web-based AvisLoader Command Center gives attackers a list of infected computers and details such as their location.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The loader incorporates c-toxcore for Tox-based command-and-control communications.

T1095Non-Application Layer ProtocolEvidence1

AvisLoader uses Tox, a peer-to-peer messaging network that does not rely on a fixed command-and-control domain or server address.

T1105Ingress Tool TransferEvidence2

From the same panel, attackers can... distribute additional files through the Tox network.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

hackreadNews

Sep 24, 2026

New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2

A 64-bit Windows loader delivered through a fake DocuSign ClickFix page. It statically links c-toxcore to use the Tox P2P network for resilient command-and-control, provides operators with system reconnaissance, remote shell-command execution, and additional-file delivery. It is designed to persist by modifying desktop and taskbar shortcuts; recovered components also include a possible UAC-bypass utility and a DLL capable of concealing selected processes.

varonis blogNews

Sep 23, 2026

Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

Windows loader delivered through ClickFix social-engineering lures. It uses the Tox P2P protocol for encrypted command-and-control and payload delivery, incorporates shortcut-modification persistence artifacts, and its command center supports host profiling, shell-command tasking, and file distribution. Recovered companion components include a UAC-bypass helper and a DLL capable of filtering process names from NtQuerySystemInformation results, though successful deployment of those functions was not confirmed.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

AvisLoader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

T1204User ExecutionEvidence1

The infection chain begins with a ClickFix lure designed to trick users into running an attacker-supplied command... asks the visitor to paste a code into a terminal.

T1204.004Malicious Copy and PasteEvidence1

The ClickFix lure instructs visitors to paste and run an attacker-supplied command.

Persistence

1 technique

T1547.009Shortcut ModificationEvidence2

Privilege Escalation

2 techniques

T1547.009Shortcut ModificationEvidence2

T1548.002Bypass User Account ControlEvidence2

The malware package also contained auto.exe, a program linked to a publicly documented Windows UAC bypass known as UACME method 41.

Stealth

3 techniques

T1014RootkitEvidence1

A separate dynamic-link library (DLL), hmn_hook.dll, provides process-hiding functionality. It hooks NtQuerySystemInformation ... and filters a specified process name from the results.

T1036MasqueradingEvidence1

This page is disguised as a DocuSign signature request and displays a prompt claiming that 'Verification is handled by Cloudflare.'

T1564.001Hidden Files and DirectoriesEvidence1

hmn_hook.dll can remove a chosen process from results returned by a Windows system-information function.

Discovery

3 techniques

T1082System Information DiscoveryEvidence1

The web-based AvisLoader Command Center gives attackers a list of infected computers and details such as their location, hardware, antivirus software and administrator status.

T1518.001Security Software DiscoveryEvidence1

The web-based AvisLoader Command Center gives attackers... details such as their location, hardware, antivirus software and administrator status.

T1614System Location DiscoveryEvidence1

The web-based AvisLoader Command Center gives attackers a list of infected computers and details such as their location.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The loader incorporates c-toxcore for Tox-based command-and-control communications.

T1095Non-Application Layer ProtocolEvidence1

AvisLoader uses Tox, a peer-to-peer messaging network that does not rely on a fixed command-and-control domain or server address.

T1105Ingress Tool TransferEvidence2

From the same panel, attackers can... distribute additional files through the Tox network.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

hackreadNews

Sep 24, 2026

New AvisLoader Windows Malware Uses ClickFix Lure and Tox P2P for C2

varonis blogNews

Sep 23, 2026

Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.