ChainScript RAT uses Polygon to shift infrastructure

Blackpoint Adversary Pursuit Group researchers Sam Decker, Andi Ursry and Nevan Beal said ChainScript was a previously undocumented remote access trojan. They said it appeared under several build names and presented itself as Spotify, Zoom Workplace and Microsoft Teams software.

According to the report, the attack began with a ClickFix lure that led to a malicious Windows MSI. The installer used msiexec.exe, deployed the Node.js runtime and started the JavaScript agent through hidden PowerShell and VBScript stages.

Blackpoint said the PowerShell script placed components such as the runtime, source, configuration and helper binaries in Microsoft-looking paths under %LOCALAPPDATA%. It said the malware set persistence with a scheduled task and a Registry Run key fallback, then connected over WebSockets to receive more instructions.

The report said ChainScript used a Polygon smart contract to locate its active command-and-control servers, which let the operator move infected hosts to new infrastructure while keeping the same implant. Blackpoint said the malware could run shell commands, handle files, take screenshots, deploy payloads, enumerate wallet software and execute remote JavaScript.

The article also described other ClickFix activity. It said HBO Max's official Reddit account was used to serve 108 malicious ads in 48 hours, while Seqrite Labs and Cato Networks described separate macOS and fake download campaigns, and Microsoft said it had seen more than 250 look-alike domains in one cluster.