That ClickFix Paste Just Installed Variola, Not a “Fix”

Blackpoint’s Adversary Pursuit Group traced a ClickFix chain that opened Windows Terminal, ran PowerShell, pulled a GitHub-hosted payload named sha, XOR-decoded it in memory, and handed execution to a previously unclassified modular Windows implant they are tracking as Variola. Not a cute stealer one-liner. A stateful framework with encrypted local storage, authenticated C2, component loading, Chromium cookie-database abuse hooks, and protobuf tasking that looks like a fraud platform pretending to be a tech support popup. Your users thought they were clearing a CAPTCHA error. They were onboarding a smallpox-themed bot.

The Blackpoint write-up landed mid-October 2026 and showed up in AlienVault OTX pulses around October 16. ClickFix (and TerminalFix cousins) have been the delivery fashion of the year: fake error pages that tell humans to paste a command into Run, PowerShell, or Windows Terminal. Variola is what happens when that social engineering stops being a loader appetizer and becomes a full tasting menu.

The lure, step by step (from Blackpoint’s intrusion)

1. ClickFix social engineering: explorer.exe into Windows Terminal and PowerShell.
2. Minimized PowerShell: rebuilds contents of an environment variable into a scriptblock, launches %TEMP%.ps1.
3. GitHub raw download: fetches sha from raw.githubusercontent.com/.../deploy/refs/heads/main/sha over TLS 1.2 with retries.
4. In-memory decode: repeating 16-byte XOR key combined with byte position; writes an eight-character GUID-named file under %TEMP%; Start-Process.
5. Rust loader → reflective MZER stage → Variola core: decrypt embedded payload, map PE manually, transfer execution. Distinctive PE section name: smallpox.

Developer strings Blackpoint recovered in the loader include gems like “I love my job & wife. My wife loves your money. Family business since 2009.” The malware authors are doing bittersweet comedy. Your SOC is not laughing.

Host IOCs worth hunting (ClickFix sha path)

• SHA-256 82357327e965c8d1bb82b277268cecc16a428da4bab472b1a60d238331fde9cf (decoded sha Rust loader)
• SHA-256 b2b1afa2905c63921433cada66ec9bbeb473eb467bf6501fc003e313b1cf1059 (reflective loader)
• SHA-256 b1b797eaecec815741d6078b698bdceb6ea1e6e75b123d9b8c1781832ffeb9f6 (embedded Variola core DLL)
• Directory %ProgramData%\4A-D3\ (primary encrypted state store); fallback C:\Windows\Temp\4A-D3\
• Host identity file uid.dat under those directories
• Mutexes Local\host-ensure-core, Local\ledger-migrate-17000
• Markers: CAv2, BHkReady_, BHnReady_, PE section smallpox, PDB path C:\dev\bot2\client\core\cmake-build-release\core.pdb

Why Variola is worse than “another ClickFix loader”

Blackpoint’s point for MSPs is the boring scary one: once the core is up, the operator is not stuck with the first payload. Variola keeps host identity (MachineGuid → SHAKE256 → 24-hex uid), runtime config, preferred controller, cached agent PE, and dynamically delivered components in an encrypted object store. Controllers are authenticated with secp256k1 ECDH, XSalsa20, and Ed25519 response signatures. URI paths are randomized from wordlists to look like enterprise junk (/api-docs/approve/activate-feature/track-changes.php style). User-agents include Microsoft-CryptoAPI and Windows-Update-Agent cosplay. HTTP header artifact: X-Api-Key: secret-token.

Built-in tasks cover software inventory, system info, download-execute, hidden PowerShell, JScript, updates, unload, terminate. Components load on demand through a CAv2 RPC surface. Protobuf definitions Blackpoint recovered also describe VNC, credential/cookie collection, wallet theft, MFA theft, keylogging, screenshots, clipboard, and session events. Not every component was in the sha build. The architecture was clearly built to grow them.

Chromium gets special love: hook NtCreateUserProcess watching for --utility-sub-type=network, inject, then loosen sharing flags on the live Network\Cookies database via NtCreateFile/NtOpenFile hooks so another module can read cookies while the browser runs. That is banking-trojan choreography wearing a ClickFix tuxedo.

Same GitHub repo, more sadness

Blackpoint found sibling builds and wrappers in the same repository: cfg, checksum, storage, license, kvt, keystore, and multiple manifest* packaging formats including NSIS+Python. Rapid same-day compiles. One unrelated treat in the same candy bowl: Aura Stealer 1.8.1 as 654.exe. The repo was a staging closet, not a one-off paste.

Related network crumbs from Blackpoint (treat as campaign-adjacent, not universal truth): domain n.alox.one; IP/port 172.86.113.167:4333 seen with a sibling sample; GitHub raw URL pattern for sha. Defang and expire as operators rotate.

What defenders should do (not vibes)

1. Reduce ClickFix execution: restrict Windows Terminal / PowerShell launches from browsers and Office; application control against unsigned executables from %TEMP% and user profile paths.
2. Hunt scripted GitHub raw downloads followed by immediate write+execute under Temp.
3. Hunt Variola artifacts: 4A-D3, uid.dat, listed mutexes, smallpox section, CAv2 strings.
4. Watch process injection and Chromium Network Service tampering; unexpected access to live Cookies DB from non-browser processes.
5. User reporting: teach that “paste this command to fix the error” is not IT. Real IT tickets do not start in a CAPTCHA modal on a random site.

Sloth take

We trained users for twenty years not to open attachments. Attackers answered with a webpage that says your browser is broken and the fix is to paste a rootkit installer into Terminal. Variola then stores your host identity like a CRM entry and opens a modular fraud workshop on your laptop. Allow-list execution. Hunt 4A-D3. And maybe stop letting ClickFix be the default enterprise onboarding flow for malware.

Phishing-resistant defaults and boring IR retainers are available. Book Dark Edge Consulting.

Awareness that is not a cartoon

Show the kill chain in training: fake error, “press Win+R / open Terminal,” paste, PowerShell, GitHub raw, Temp EXE, quiet implant. Ask which step felt safe because it looked like troubleshooting. That is the lesson. Do not shame curiosity. Shame the process that allows arbitrary PowerShell from a browser-spawned Terminal without a ticket.

Executives get prettier HTML. Same rules. Especially around “your password expires today” and “Teams needs a fix” lures that somehow require a clipboard command.

EDR ideas that survive hash rotation

• Parent/child: browser or explorer → Windows Terminal / pwsh → download from raw.githubusercontent.com → Temp execute
• File: creation of %ProgramData%\4A-D3\ or uid.dat there
• Mutex: Local\host-ensure-core, Local\ledger-migrate-17000
• Module: PE with section name smallpox; strings WALLET_THEFT_EXECUTE, MFA_THEFT_EXECUTE, CAv2
• Browser: non-browser process opening Chromium Network\Cookies with odd sharing flags after Network Service spawn

ThreatFox adjacency (do not conflate)

On any given day ThreatFox will light up with Vidar, AMOS, Mirai, and random stealer C2s. Those are separate dramas. Use Blackpoint’s Variola hashes, paths, and mutexes for this story. Keep ClickFix behavioral detections generic so the next GitHub repo name does not require a new blog post to catch.

MSP blast radius

Blackpoint explicitly frames Variola as an MSP problem because RMM estates turn one ClickFix paste into a lateral-movement buffet. If your technicians still run with local admin everywhere and browser sessions full of customer portals, a modular implant with cookie-database hooks is how “one laptop” becomes “every tenant that tech touched this week.” Segment tech workstations. Force phishing-resistant MFA on admin paths. Assume browser sessions are credentials.

What not to do

• Do not “clean” Variola by deleting one Temp EXE and calling it done. The encrypted 4A-D3 store and component cache are the point.
• Do not reset passwords from the infected host.
• Do not ignore sibling hashes from the same GitHub staging repo when scoping the campaign.
• Do not train users with only fake Microsoft 365 login pages while ClickFix paste lures run the real world.

Clipboard hygiene for humans who still have jobs

If a webpage tells you to paste into Terminal, stop. Call the number on your IT portal badge, not the number in the modal. If you already pasted, disconnect, report, and let IR collect before you “helpfully” reboot. Variola’s whole design assumes you will keep working while it loads modules. Do not gift it the afternoon.

Related ClickFix neighborhood (context only)

Industry reporting through 2025 and 2026 described ClickFix and TerminalFix delivering assorted loaders and ransomware precursors. Forescout and others have written about multi-payload panels and loader families in that delivery niche. Variola is a specific Blackpoint-tracked implant reached through one ClickFix chain. Do not mash every ClickFix headline into one IOC list. Do mash the user behavior: paste-to-fix is hostile until proven otherwise.

Network IOC from Blackpoint for the sha path should be defanged in controls: GitHub raw URL for sha, and related infra like n.alox[.]one and 172.86.113[.]167:4333 where your intel pipeline can expire them. Prefer behavioral detections over eternal blocklists.

Sources

• Blackpoint Cyber APG, “Variola: From ClickFix to a Modular Implant” (Oct 2026)
• AlienVault OTX pulse recirculation (created/modified around 2026-10-16)
• Public ClickFix / TerminalFix campaign context from broader 2025-2026 industry reporting (delivery method family only)