Variola: From ClickFix to a Modular Implant

Blackpoint's Adversary Pursuit Group identified Variola, a previously unclassified modular Windows implant traced from a ClickFix intrusion. Variola maintains persistent host identity through encrypted storage and preserves configuration and controller data across executions. It employs authenticated command-and-control with controller rotation and uses XSalsa20 encryption, secp256k1 key exchange, and Ed25519 signatures for secure communications. Its modular architecture allows operators to load components dynamically for credential theft, browser manipulation, and session hijacking. The implant demonstrates banking trojan behaviors including Chromium process injection, live cookie database access, and VNC-style remote access. Multiple related builds found in the same GitHub repository indicate ongoing development and experimentation.

The implant enables attackers to maintain persistent control over infected Windows hosts, steal credentials, manipulate browsers, hijack sessions, and remotely access systems in a manner consistent with banking trojans. This can lead to unauthorized access to sensitive information and potential financial theft. No active exploitation in the wild has been reported yet.

No official patch or remediation guidance is provided. Organizations should monitor for indicators of compromise such as the listed hashes and domain, and apply standard endpoint detection and response measures to detect and remove this malware. Since no vendor advisory or patch information is available, patch status is not yet confirmed — check vendor advisories for updates.