Varonis Threat Labs has documented AvisLoader, a Windows malware loader that does not depend on a domain defenders can seize. It talks to its operator over Tox, an encrypted peer-to-peer messaging network.

What happened

BleepingComputer published the Varonis write-up on 12 October 2026. Researchers found the loader on an exposed staging server, next to a ClickFix lure, helper tools, and a web command center. The name comes from the Latin word for bird. Varonis also saw it advertised for sale. The seller claims the controller can move to a new server by copying a Tox save file, and that infected clients follow without a domain update.

The lure they recovered was a fake document-signing page on Cloudflare Workers. The visitor is asked to copy and run a command. The Windows payload is a 3.4 MB 64-bit executable that runs with the privileges of whatever launched it. It does not ask for elevation at startup. It statically links c-toxcore. Varonis did not publish a victim count, so this is a capability report, not a confirmed outbreak.

Who is affected

Windows users who can be talked into pasting a command from a browser page. That is finance, legal, and operations staff who already expect document-signing prompts, plus any helpdesk that walks users through a run-this-to-fix-it step. Because control rides on Tox rather than a callback domain, blocking one hostname does not end the session.

What to do now

Block the ClickFix habit: no user should paste a command from a web page into Run, PowerShell, or Terminal, including pages that look like a signature request. Then look for Tox where it does not belong.

• Alert on new shortcuts in Startup and on unexpected processes that load a Tox library or talk to the Tox network.
• Treat Cloudflare Workers pages that instruct a paste-and-run step as phishing, not as a document portal.
• If a host is infected, assume the operator can move the controller. Isolation has to include the peer channel, not only a domain block.

Source: BleepingComputer / Varonis Threat Labs, 12 October 2026. Read the analysis.

Also on the blog

• Ahold Delhaize takes systems offline after network security issue
• CyberXero used Claude Code to steal 628,000 Ukrainian records

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.