ChainScript RAT: a ClickFix-delivered trojan that hides its C2 pointer in a Polygon smart contract

Executive Summary

Researchers at Blackpoint's Adversary Pursuit Group (APG) have documented ChainScript, a previously undocumented, full-featured remote access trojan delivered through ClickFix-style social engineering and notable for how it finds its command-and-control infrastructure: an EtherHiding-style scheme that reads a Polygon smart contract to locate the operator's currently active WebSocket servers.¹ The malware has appeared under several build names — ComponentTask33, UpdateDigital, HostShared and OrchidViolet66 — while masquerading as Spotify, Zoom Workplace and Microsoft Teams software.¹

The attack chain begins with a ClickFix lure — the now-familiar fake verification or update page that instructs the visitor to paste and run a command themselves — which leads to the download and execution of a malicious Windows installer via msiexec.exe.¹ One observed installer, ComponentTask33-4d14e6ac.msi, is disguised as Spotify; it deploys a Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages.¹ The PowerShell stage drops the runtime, agent source, configuration and auxiliary binaries into Microsoft-looking paths under %LOCALAPPDATA%, and a VBScript serves as the launcher; the running agent establishes user-level persistence through a scheduled task with a Registry Run-key fallback.¹ Once running, ChainScript connects to its C2 over WebSockets and pulls tasking, giving the operator interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, remote JavaScript execution, and cryptocurrency-wallet enumeration across both desktop applications and browser extensions — plus commands to self-update and remove its own persistence.¹

The reason ChainScript is worth a paper is the C2-discovery design, not the RAT features, which are conventional. By putting the pointer to its live infrastructure in a Polygon smart contract rather than hard-coding domains or IPs in the implant, the operator separates "where do I connect" from the malware itself. Blackpoint's assessment is that this lets the operator "redirect infected hosts to new infrastructure while retaining the same implant and reconnect workflow," resisting takedown and complicating traditional indicator-based detection — because the blockchain entry can be updated at will and the smart contract cannot be seized or sinkholed the way a domain can.¹ Blackpoint is explicit that this is part of a broader trend: "like many malware families observed in recent months," ChainScript uses blockchain-based C2 discovery — so the technique is an adopted pattern, not a ChainScript invention.¹

ChainScript is one strand of a wider surge in ClickFix-delivered malware. Separate, distinct campaigns reported in the same period include PasteSwitch (Hudson Rock and ADAMnetworks), in which HBO Max's verified Reddit account was hijacked to run 108 malicious ads over 48 hours delivering MacSync, Atomic macOS Stealer and Windows stealers/clippers; a fake "Codex download" campaign delivering Atomic Stealer to macOS via Terminal (Cato Networks); and a macOS ClickFix cluster of 250+ look-alike domains with browser-fingerprint cloaking (Microsoft).¹ These are separate operations with different malware and are noted here only as context for the delivery technique — they are not ChainScript.

Verification of Claims

1. Claim: ChainScript is a previously undocumented, full-featured RAT delivered via ClickFix. → Verified (single-vendor disclosure) → Documented by Blackpoint APG researchers (Sam Decker, Andi Ursry, Nevan Beal) and reported by The Hacker News, with a corroborating mention in Mallory's coverage of ClickFix-delivered ChainScript.¹²

2. Claim: ChainScript locates its C2 via a Polygon smart contract (EtherHiding-style). → Verified (per Blackpoint) → Described in Blackpoint's technical analysis: the malware reads a Polygon smart contract to find its active WebSocket infrastructure, separating C2 discovery from the implant.¹

3. Claim: Blockchain-based C2 discovery is unique to ChainScript. → False → Blackpoint states ChainScript uses this technique "like many malware families observed in recent months"; EtherHiding-style blockchain C2 is an established and increasingly common pattern, not novel to this RAT.¹

Timeline

Attack Anatomy

Delivery — ClickFix to msiexec

The chain starts with a ClickFix lure that gets the victim to run a command, leading to download and execution of a malicious Windows installer through msiexec.exe (T1204.004, T1218.007).¹ The installer (ComponentTask33-4d14e6ac.msi) is disguised as Spotify (T1036).¹

Staging — Node.js, PowerShell and VBScript

The installer deploys a Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages (T1059.001, T1059.005, T1059.007). The PowerShell stage drops the runtime, agent source, configuration and auxiliary binaries into Microsoft-looking paths under %LOCALAPPDATA%, and a VBScript acts as the main launcher.¹

Persistence

The running agent establishes user-level persistence through a scheduled task, with a Registry Run-key fallback (T1053.005, T1547.001).¹

C2 discovery and tasking — the Polygon resolver

Rather than embedding C2 addresses, the implant reads a Polygon smart contract that resolves to the operator's currently active WebSocket infrastructure (T1102.001), then connects over WebSockets to retrieve tasking (T1102.002). Supported commands include interactive CMD/PowerShell, file operations, screenshot capture (T1113), payload deployment, remote JavaScript execution, cryptocurrency-wallet enumeration across desktop apps and browser extensions (T1005), self-update, and removal of persistence.¹

Threat Actor Profile

• Attacker: Unattributed. Blackpoint documents the malware and its delivery but does not attribute ChainScript to a named group.¹
• Attribution confidence: Not applicable — no named actor.
• Objective: Broad remote control with a clear financial component — cryptocurrency-wallet enumeration across desktop applications and browser extensions points to crypto theft, consistent with the wider ClickFix ecosystem's stealer-and-clipper economy.¹
• Tradecraft of note: Development-framework tooling (a Node.js/JavaScript implant) plus blockchain-based C2 discovery. Blackpoint frames this as "an emerging pattern of malware using development frameworks and blockchain-based C2 discovery to enable infrastructure rotation and complicate traditional indicator-based detection."¹

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

malware: "ChainScript RAT (Node.js/JavaScript agent)"
build_names:
  - ComponentTask33
  - UpdateDigital
  - HostShared
  - OrchidViolet66
masquerades_as:
  - "Spotify"
  - "Zoom Workplace"
  - "Microsoft Teams"
observed_installer:
  - "ComponentTask33-4d14e6ac.msi (disguised as Spotify, run via msiexec.exe)"
staging:
  - "Node.js runtime, agent source, config and auxiliary binaries dropped to Microsoft-looking paths under %LOCALAPPDATA%"
  - "hidden PowerShell dropper; VBScript launcher"
persistence:
  - "scheduled task (user level)"
  - "Registry Run key (fallback)"
c2:
  - "C2 discovery via a Polygon smart contract (EtherHiding-style dead-drop resolver)"
  - "tasking over WebSockets"
capabilities:
  - "interactive CMD/PowerShell, file ops, screenshots, payload deployment, remote JS execution"
  - "cryptocurrency wallet enumeration (desktop apps and browser extensions)"
  - "self-update; remove persistence"
network_iocs: >
  No static C2 domains/IPs are meaningful by design — the live infrastructure is
  resolved from the Polygon contract and rotated. Hunt on the on-host behaviour
  (msiexec launching a Spotify-named MSI, Node.js under %LOCALAPPDATA%, the
  scheduled task/Run-key pair) rather than fixed network indicators.
file_hashes: none published in the reporting reviewed

Legal and Regulatory Response

No law-enforcement action, takedown, or regulatory advisory tied specifically to ChainScript had been reported as of publication. The disclosure is vendor threat research (Blackpoint APG), reported by The Hacker News.¹ The blockchain-based C2 design is, in part, a deliberate answer to takedown efforts: a smart contract on a public chain cannot be seized or sinkholed the way an attacker-controlled domain can, which is the practical obstacle any future disruption would have to work around.¹

Impact Assessment

• Confirmed: ChainScript is an active, full-featured RAT delivered via ClickFix, with interactive shell access, screenshot capture, remote code execution and cryptocurrency-wallet enumeration, using a Polygon smart contract for resilient C2 discovery.¹
• Reported: Multiple build names and software-impersonation themes (Spotify, Zoom Workplace, Microsoft Teams) indicate an ongoing, iterated campaign rather than a one-off.¹
• Unknown: The number of victims, the operator's identity, the geographic distribution of infections, and confirmed financial losses — none were quantified in the reporting reviewed.¹
• Context (not ChainScript): A broader ClickFix wave in the same period — PasteSwitch via HBO Max's hijacked Reddit account, a fake Codex/Atomic Stealer campaign, and a 250+ look-alike-domain macOS cluster — indicates ClickFix delivery is being used across many unrelated operations.¹

Lessons and Defensive Recommendations

For SOC and endpoint teams:

• Indicator-based blocking of C2 domains is the wrong primary control here, by design: the live infrastructure is resolved from a Polygon smart contract and rotated at the operator's convenience. Detect on the host behaviour instead — msiexec.exe executing a consumer-app-named MSI (e.g., a "Spotify" installer) that then spawns a Node.js runtime from %LOCALAPPDATA%, a VBScript launcher, and a newly created scheduled task paired with a Run-key entry.
• Treat outbound WebSocket connections initiated by a Node.js process running from a user-profile path as suspicious on endpoints with no development role, and flag reads/queries to public blockchain RPC endpoints from non-developer hosts as a possible EtherHiding-style C2-resolution step.

For platform and detection engineers:

• Blockchain-hosted C2 resolvers move the takedown problem from "seize a domain" to "the pointer lives on an immutable public ledger." Disruption has to target the operator's ability to update the contract or the downstream WebSocket hosts, not the contract itself. Build detections and threat models around that reality now, because Blackpoint's framing — that this is spreading across many families — means it will not stay rare.

For users and administrators:

• The entry point is still a human pasting a command. ClickFix defeats a great deal of technical control by getting the victim to run the payload themselves, so the highest-leverage control is user-facing: train staff that no legitimate site, CAPTCHA, or "meeting error" ever asks you to paste a command into the Run dialog or a terminal, and restrict msiexec execution of installers from user-writable/temporary locations where feasible.

Sources