New ChainScript RAT Uses Blockchain-Based C2 and ClickFix Lures
Cybersecurity researchers have uncovered a previously undocumented remote access trojan (RAT) called ChainScript, which is being distributed through ClickFix-style social engineering campaigns and uses blockchain-based infrastructure to locate its command-and-control (C2) servers.
According to researchers from Blackpoint Adversary Pursuit Group (APG), ChainScript has appeared under several build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. The malware has also been disguised as legitimate applications such as Spotify, Zoom Workplace, and Microsoft Teams.
ChainScript provides attackers with extensive remote access to compromised Windows systems. Its capabilities include interactive Command Prompt and PowerShell access, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration, and remote JavaScript execution.
ClickFix Used as the Initial Infection Method
The attack begins with a ClickFix-style lure designed to convince users to execute a malicious command or download a fake software installer.
In the observed campaign, victims are directed toward a malicious Windows installer named ComponentTask33-4d14e6ac.msi, which is disguised as Spotify software.
The installer uses msiexec.exe to execute and deploy the Node.js runtime along with the ChainScript JavaScript agent. Additional PowerShell and VBScript stages are then used to install and launch the malware.
The PowerShell component places the Node.js runtime, ChainScript source code, configuration files, and other supporting binaries inside Microsoft-looking directories under the user's %LOCALAPPDATA% folder.
A VBScript component acts as the primary launcher for the malware.
ChainScript Establishes Persistence
After execution, ChainScript establishes user-level persistence through a scheduled task. A Windows Registry Run key is also used as a fallback mechanism.
Once active, the malware establishes a WebSocket connection with its C2 infrastructure and waits for instructions from the attacker.
The available commands allow operators to remotely control the compromised system, execute commands, perform file operations, deploy additional payloads, capture screenshots, and update or remove the malware.
Blockchain Used for C2 Discovery
One of the most notable characteristics of ChainScript is its use of a blockchain-based C2 discovery mechanism.
Instead of embedding a fixed C2 server address directly into the malware, ChainScript uses a technique similar to EtherHiding.
The malware communicates with a Polygon smart contract to identify the active WebSocket infrastructure.
This approach gives operators greater flexibility because the backend infrastructure can be changed without modifying or redistributing the malware itself.
Blackpoint researchers said that separating infrastructure discovery from the malware allows attackers to redirect infected systems toward new servers while retaining the same ChainScript implant.
The technique can also make traditional indicator-based detection and infrastructure takedown efforts more difficult.
Extensive Remote Access Capabilities
ChainScript functions as a full-featured RAT with several capabilities designed to provide attackers with broad control over infected systems.
Its functionality includes:
- Interactive Command Prompt access
- PowerShell execution
- File upload and download
- File management
- Screenshot capture
- Payload deployment
- Remote JavaScript execution
- Cryptocurrency wallet enumeration
- Browser extension wallet discovery
- C2 communication through WebSockets
- Malware self-update functionality
- Persistence removal
The cryptocurrency wallet functionality allows attackers to search for wallet applications and browser extensions installed on compromised systems.
ClickFix Continues to Drive Malware Campaigns
The ChainScript discovery comes as ClickFix-style attacks continue to be used by threat actors to convince users to execute malicious commands themselves.
In another recent campaign, attackers compromised the official Reddit account of HBO Max and used it to distribute malicious advertisements.
The campaign, tracked as PasteSwitch, reportedly used the compromised account to distribute ClickFix lures targeting both Windows and macOS users.
Researchers identified multiple malware families associated with the activity, including MacSync, Atomic macOS Stealer, Amatera Stealer, AnimateClipper, and ZigClipper.
According to researchers, 108 malicious advertisements were served through the compromised Reddit account over a 48-hour period in September 2026.
macOS Users Also Targeted
The macOS component of the PasteSwitch campaign delivered information-stealing malware and fake cryptocurrency wallet applications designed to steal cryptocurrency recovery phrases.
Another ClickFix campaign used fake Codex download pages and search engine results to direct macOS users to malicious Google Sites pages.
Victims were instructed to copy and paste commands into the macOS Terminal. The commands downloaded and executed multiple stages of a malicious shell script before ultimately deploying Atomic Stealer.
Researchers said these campaigns demonstrate how attackers are increasingly abusing trusted platforms, search results, shared AI conversations, and legitimate-looking websites to make malicious installation instructions appear credible.
Increasing Use of Trusted Services
The ChainScript campaign highlights a broader trend in which malware operators use legitimate or decentralized services as part of their infrastructure.
By using blockchain-based C2 discovery, threat actors can separate the malware from its backend infrastructure and change the destination used by infected systems.
This makes it more difficult for defenders to rely solely on static indicators such as IP addresses and domain names.
Blackpoint researchers described ChainScript as an example of malware combining modern development frameworks with blockchain-based infrastructure to support infrastructure rotation and improve resilience against takedown efforts.
Organizations and users should remain cautious of ClickFix-style instructions that ask them to manually execute commands, install software from unofficial sources, or paste commands into PowerShell or Terminal.
Keeping operating systems and security software updated, restricting unnecessary script execution, and carefully reviewing browser extensions and downloaded installers can help reduce the risk of infection.
