OTX Threat: Variola: From ClickFix to a Modular Implant

Blackpoint's Adversary Pursuit Group traced a ClickFix intrusion to a previously unclassified modular Windows implant designated Variola. The malware establishes persistent host identity through encrypted storage, maintains configuration and controller information across executions, and employs authenticated command-and-control with controller rotation capabilities. Variola's modular architecture