ChainScript: a new RAT hides its C2 lookup in a Polygon smart contract

Researchers at Blackpoint's Adversary Pursuit Group (APG) have detailed a previously undocumented remote access trojan named ChainScript. It spreads through ClickFix-style lures and poses as legitimate software — Spotify, Zoom Workplace and Microsoft Teams — appearing under several build names such as ComponentTask33, UpdateDigital, HostShared and OrchidViolet66.

Blockchain as an address book

ChainScript's defining trait is an EtherHiding-style approach to locating its command-and-control servers. Instead of hard-coded addresses, the malware queries a smart contract on the Polygon network to discover its active WebSocket infrastructure. By separating this "directory" from the implant itself, the operator can redirect infected hosts to new servers without touching the malware's code, keeping the same reconnect workflow. This decentralized design resists takedowns and complicates indicator-based detection.

How the infection unfolds

The chain starts with a ClickFix lure that leads to downloading and running a malicious Windows installer via msiexec.exe. The MSI package, disguised as Spotify, deploys the Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages. PowerShell drops the components — runtime, agent source, configuration and auxiliary binaries — into Microsoft-looking paths under %LOCALAPPDATA%. The VBScript acts as the main launcher.

Persistence is achieved through a scheduled task, with a Registry Run key as a fallback. Once running, the agent connects to the C2 over WebSockets and pulls further tasking.

Capabilities

ChainScript is a full-featured RAT: interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration (both desktop apps and browser extensions), and remote JavaScript execution. It also supports self-update and removal of its own persistence.

Blackpoint frames ChainScript as part of a growing pattern in which attackers lean on development frameworks and blockchain-based C2 discovery to rotate infrastructure and slip past traditional indicator-based detection.

Source: The Hacker News