Loading story…
Varonis Threat Labs identified AvisLoader, a 64-bit Windows loader spread through a ClickFix lure impersonating a DocuSign signature request. Victims are instructed to paste an attacker-controlled command into a terminal, which retrieves code through a Cloudflare Quick Tunnel and bypasses normal browser download controls.
AvisLoader statically links c-toxcore and uses the encrypted, decentralized Tox peer-to-peer network for command-and-control and payload delivery, eliminating dependence on a fixed server or domain and complicating takedowns. Its command center supports host inventory, attribute-based tasking, shell-command execution, and file staging; recovered components also indicate possible shortcut-based persistence, UAC bypass, and process hiding, although successful deployment of those capabilities was not confirmed.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Varonis Threat Labs discovered the AvisLoader Windows loader on an exposed staging server alongside a ClickFix lure, supporting tools, and an AvisLoader Command Center. The recovered materials revealed a DocuSign-themed lure that directed victims to execute a command retrieving code through a Cloudflare Quick Tunnel, while the loader used Tox peer-to-peer communications for command-and-control and payload delivery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **PavinLoader**, a multi-stage `.NET` malware loader, to several intrusion chains that used **ClickFix lures, fake software downloads, and malicious RenPy packages** to infect victims. Across the campaigns, operators relied on trojanized and heavily obfuscated `.NET` DLLs, along with abuse of **MSBuild** through `.csproj` and `.bat` files, to execute later stages while complicating analysis and detection. The loader retrieved command-and-control details using **EtherHiding**, including Binance Smart Chain RPC calls to pull infrastructure data from blockchain-hosted content, and then fetched additional payloads. In observed cases, PavinLoader delivered **Amatera Stealer** and at times **HijackLoader**, while also using anti-analysis and anti-forensics measures such as AMSI/ETW-related evasion strings, virtualization checks, locale filtering, and infrastructure-provider checks; shared artifacts and builder-like scripts led researchers to assess that it may be operated as a **Loader-as-a-Service**, though no commercial panel or offering was confirmed.
Aug 25, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Cato CTRL reported a previously undocumented malware loader dubbed **Foxveil** that abuses legitimate services—**Cloudflare Pages**, **Netlify**, and short-lived **Discord** attachments—to stage and retrieve next-stage payloads while blending into normal cloud traffic. The campaign has been assessed as active since **August 2025** and uses **Donut-generated shellcode** with **in-memory execution** to reduce on-disk artifacts; it also employs a **string-mutation** routine that rewrites “high-signal” analysis keywords (e.g., `payload`, `inject`, `shellcode`, `beacon`, `http://`, `.exe`) at runtime to complicate static detection and reverse engineering. Two variants were described. **Foxveil v1** retrieves payloads from Cloudflare/Netlify, spawns a process impersonating `svchost.exe`, and injects code using **Early Bird APC injection** (queuing the APC while the target process is suspended), then establishes persistence by registering as a **Windows service**; **Foxveil v2** instead performs **self-injection** and was observed attempting to manipulate **Microsoft Defender** settings, but appears to mistakenly remove (rather than add) an exclusion for the `SysWOW64` path. Both variants drop next-stage payloads into `SysWOW64`, and Cato reported the malicious staging infrastructure to providers—Netlify confirmed takedown of reported URLs (Jan 19, 2026) and Cloudflare restricted access to reported URLs (Jan 20, 2026)—while Discord attachment links observed were no longer active due to their time-limited nature; Cato also noted potential follow-on use of frameworks such as **Cobalt Strike**.
Jun 29, 2026