AvisLoader Windows Malware That Learned to Survive Even After Its Servers Are Taken Down

AvisLoader is a Windows malware loader built to keep taking instructions after server takedowns. That makes it difficult to disrupt by simply removing a malicious website. It starts with a fake document-signing page that asks visitors to run a command themselves, turning a familiar verification request into a possible infection on the device. The signing page demands a manual check, claiming a security provider handles it. Instead of verifying anything, the pasted command retrieves and runs code through a temporary tunnel instead of a normal browser download. It mirrors fake verification page tactics seen in other ClickFix campaigns and makes the user launch the attack. Varonis Threat Labs identified AvisLoader on an exposed...

Read the full article at the source.