- Published on
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
- Authors
- Name
- DeepHorus
Threat actors are exploiting ClickFix-style lures to distribute a previously undocumented remote access trojan named ChainScript. Researchers from Blackpoint's Adversary Pursuit Group detailed the malware, noting it has appeared under multiple build names such as ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. The RAT disguises itself as legitimate software including Spotify, Zoom Workplace, and Microsoft Teams to trick users into executing malicious installers.
ChainScript employs an EtherHiding-style command-and-control discovery technique that relies on a Polygon smart contract to locate its active WebSocket infrastructure. This approach separates backend discovery from the malware itself, allowing operators to rotate C2 servers without changing the implant. The RAT is full-featured, providing interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration, and remote JavaScript execution.
The attack chain begins with a ClickFix lure that prompts the download of a malicious Windows installer launched via msiexec.exe. The installer, disguised as Spotify, deploys the Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages. The PowerShell script drops components across Microsoft-looking paths in the %LOCALAPPDATA% folder, while the VBScript acts as the main launcher. The agent establishes user-level persistence through a scheduled task with a Registry Run key fallback, then connects to the C2 server over WebSockets.
Blackpoint researchers Sam Decker, Andi Ursry, and Nevan Beal said ChainScript reflects an emerging pattern of malware using development frameworks and blockchain-based C2 discovery. "By separating backend discovery from the malware itself and using the Polygon contract as an external resolver, the operator can redirect infected hosts to new infrastructure while retaining the same implant and reconnect workflow," they noted. This decentralized approach complicates traditional indicator-based detection and resists takedown efforts.
The disclosure coincides with a separate ClickFix campaign dubbed PasteSwitch, in which threat actors compromised HBO Max's official Reddit account. The account served 108 malicious ads over a 48-hour period in mid-September 2026, pushing fake ads that infected Windows and macOS devices with info-stealing malware. On macOS, PasteSwitch delivered MacSync, Atomic macOS Stealer, and fake cryptocurrency wallet applications; on Windows, it distributed Amatera Stealer and cryptocurrency clippers like AnimateClipper and ZigClipper.
Seqrite Labs data shows MacSync infections concentrated in the U.S., followed by the U.K., Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands. Researcher Chandra Kant Bauri noted the campaigns primarily target regions with widespread macOS enterprise use, tech and software development sectors, and active cryptocurrency or Web3 communities. The threat actors used highly polished assets to establish trust before delivering the malicious payload.
The findings underscore a broader shift toward flexible, decentralized infrastructure in cyberattacks. By leveraging blockchain-based resolvers and legitimate development frameworks, malware operators can maintain uninterrupted control over compromised systems. As ClickFix lures continue to evolve, defenders will need to adapt their detection strategies to account for infrastructure rotation and the abuse of trusted platforms.
