Standard
Tox is an open-source, encrypted peer-to-peer messaging protocol that runs over a DHT without central servers; c-toxcore is its reference implementation.
Varonis Threat Labs found AvisLoader, a Windows loader whose C2 runs over the Tox P2P network with no fixed domain. Varonis says that makes domain takedowns harder, though the Tox connections stay observable next to the loader's activity on the host.
Reality
Huntress worked two Settra intrusions, in July and September, and found MeshAgent installed for remote control, Windows event logs cleared and recovery partitions removed. SOCRadar counts 93 victims claimed since June.
Reality
AvisLoader statically links the reference Tox client, so its operator keeps the same identity after moving to a new server. The ClickFix page and Cloudflare tunnel that deliver it are still ordinary takedown targets.
Reality
Since uv 0.12.0 landed on July 28, 2026, uv init has written a src layout and a uv_build build-system table by default. The old --package tip is now backwards, and --no-package is the way back to a flat main.py.
Reality
Joe Security's teardown of an AArch64 Tox botnet shows a model proposing actions that only an operator command executes, which puts the telemetry worth collecting on the controller rather than on any victim host.
Reality