ChainScript RAT uses Polygon smart contract to rotate command-and-control

Researchers at Blackpoint’s Adversary Pursuit Group have documented a previously unseen remote access trojan called ChainScript, delivered through ClickFix-style lures. The malware masquerades as Spotify, Zoom Workplace and Microsoft Teams installers, appearing under build names including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66.

The attack begins with a ClickFix lure that runs a malicious MSI through msiexec.exe. The installer deploys the Node.js runtime and launches a JavaScript agent via hidden PowerShell and VBScript stages, dropping components into Microsoft-lookalike folders under %LOCALAPPDATA%. The agent establishes user-level persistence through a scheduled task with a Registry Run key fallback.

ChainScript uses an EtherHiding-style technique, resolving its live WebSocket infrastructure through a Polygon smart contract so operators can redirect infected hosts to new servers while keeping the same implant. Its commands cover interactive CMD and PowerShell, file operations, screenshots, payload deployment, cryptocurrency wallet enumeration and remote JavaScript execution.

Blackpoint said the approach separates backend discovery from the malware itself, complicating indicator-based detection and resisting takedown. The disclosure follows a separate ClickFix campaign in which attackers hijacked HBO Max’s verified Reddit account to serve 108 malicious ads over 48 hours, spreading MacSync, Atomic Stealer and Windows infostealers.