Researchers at Varonis have documented a new Windows malware loader named AvisLoader. Unlike typical loaders that phone home to fixed servers, AvisLoader uses an encrypted peer-to-peer network for command-and-control, making it harder for defenders to disrupt by seizing a single domain or IP.
According to BleepingComputer's write-up, the loader is delivered through ClickFix, a social engineering tactic that tricks users into pasting malicious commands. Once running, it establishes persistence using Windows shortcut files and can execute remote commands, giving attackers a foothold for further activity.
The design choices suggest a deliberate effort to build resilience into the malware's infrastructure. Because there is only one source, the findings are based on Varonis's analysis as reported by BleepingComputer; no independent verification is yet available.