Researchers find Windows malware using Tox for control

Security researchers have identified AvisLoader, a new Windows malware loader that uses the encrypted Tox peer-to-peer messaging network for command and control. Unlike traditional malware, it doesn't rely on static command servers, making takedown more difficult. Initial infections stem from fake document-signing requests, which trick users into running malicious commands. The malware disguises itself with multiple fake packer signatures and inherits user privileges upon execution.

• Malware communicates using encrypted Tox P2P network
• Initial lure mimics DocuSign-style signing request
• Command runs outside browser, via pasted terminal command
• Loader uses multiple fake packer section names
• Researchers found no macOS version in recovered files