AvisLoader Malware Uses Encrypted P2P Channels to Thwart Disruption, Researchers Find

Security researchers have identified a new Windows-based malware loader dubbed AvisLoader that relies on encrypted peer-to-peer (P2P) communications to hide its command-and-control (C2) infrastructure, making takedown efforts considerably more difficult.

The malware is first delivered through a tool known as ClickFix, a legitimate-looking utility often used to claim system repairs. Once installed, AvisLoader creates persistence by dropping shortcut files that point to its malicious payload, ensuring it launches each time the user logs on.

Beyond persistence, AvisLoader is equipped to execute remote commands from its operators. The loader decrypts instructions received over the P2P network, allowing attackers to run arbitrary code, download additional modules, or exfiltrate data without relying on a fixed server that could be blacklisted or seized.

Using a decentralized P2P model for C2 is a growing trend among threat actors because it eliminates a single point of failure. Encrypted traffic further obscures the communication, evading typical network‑based detection tools that look for clear‑text beaconing to known malicious domains.

Varonis analysts note that the combination of ClickFix delivery, shortcut‑based persistence, and encrypted P2P channels reflects a maturation of loader design. By blending social engineering with technical evasion, AvisLoader can infiltrate corporate environments that may already have defenses against more conventional malware families.

Experts advise organizations to monitor for unusual shortcut files in startup locations, scrutinize the presence of unknown utilities like ClickFix, and employ deep packet inspection capable of identifying encrypted anomalies. As threat actors continue to adopt resilient architectures, defenders will need to adapt detection strategies that look beyond static indicators and focus on behavioral patterns across the network.