Varonis Researchers Detail AvisLoader Malware Loader Using Encrypted P2P and ClickFix Delivery

According to a report published by BleepingComputer on October 12, 2026, Varonis researchers analyzed a new Windows malware loader identified as AvisLoader. The threat actor operations leverage encrypted peer-to-peer (P2P) communications as a mechanism to make command-and-control (CCO) infrastructure more difficult to disrupt. The malware is delivered to target systems through ClickFix social engineering tactics, which typically involve tricking users into executing commands that result in malware installation. Once executed, AvisLoader creates shortcut files in the system's startup directory to maintain persistence across reboots. The loader also provides remote command execution capabilities to the threat actor, allowing arbitrary command execution on the compromised endpoint. Varonis notes that the combination of encrypted P2P communications, ClickFix delivery, and shortcut-based persistence represents a design focused on resilience and resistance to traditional disruption methods such as sinkholing or CCO takedowns. As of the report date, no official patch or vendor advisory has been released addressing AvisLoader specifically. Mitigation guidance focuses on user education regarding ClickFix tactics, monitoring for unauthorized shortcut file creation in startup directories, and network segmentation to limit the impact of P2P communication attempts.