The ChainScript RAT campaign highlights an important evolution in cybercriminal tactics: combining social engineering, legitimate Windows utilities and blockchain infrastructure to establish persistent access while complicating traditional security detection.

Attackers use ClickFix-style lures and fake software installers impersonating applications such as Spotify, Zoom and Microsoft Teams to trick users into executing malware. Once installed, ChainScript uses Node.js, PowerShell and VBScript to establish persistence and deliver remote-access capabilities.

What makes ChainScript particularly concerning is its use of a Polygon blockchain smart contract to discover its command-and-control infrastructure. Attackers can change their active servers without modifying the malware, reducing the effectiveness of security measures that rely exclusively on static IP addresses and domain blocklists.

The malware can execute remote commands, capture screenshots, transfer files, enumerate cryptocurrency wallets and deploy additional payloads. A successful infection could therefore lead to credential theft, sensitive data exposure and further compromise of connected systems.

What should organisations do? Security teams should restrict unapproved software installations, train employees to recognise fake repair instructions, monitor suspicious PowerShell and Node.js activity, and investigate unusual outbound WebSocket connections. Endpoint detection and response, intrusion prevention, DNS security and network traffic analysis should work together to identify both the initial infection and subsequent command-and-control activity.

Importantly, blockchain traffic alone is not evidence of malware. Detection should correlate suspicious processes, known malicious contract interactions and abnormal network behaviour to avoid false positives.

The key takeaway: ChainScript demonstrates that blocking a malicious domain or IP address is no longer sufficient when malware can dynamically discover new infrastructure. Effective protection requires behavioural detection, continuous endpoint monitoring and visibility into the complete attack chain, from the initial ClickFix lure to persistent remote access.

The Hacker News

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

Source: ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure via The Hacker News — published 21 Sep 2026.