Click Fix Lures Deploy Chain Script RAT Using Polygon to Rotate C2 Infrastructure
Summary: Blackpoint Adversary Pursuit Group researchers documented ChainScript, a previously undocumented RAT distributed through ClickFix lures via a malicious MSI disguised as Spotify that installs the Node.js runtime and launches a JavaScript agent through hidden PowerShell and VBScript stages. ChainScript finds its command-and-control over WebSockets by resolving a Polygon smart contract, and provides interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration, and remote JavaScript execution.
Why it matters: Because the Polygon contract acts as an external resolver separate from the implant, the operator can redirect already-infected hosts to new infrastructure while keeping the same implant and reconnect workflow, which defeats indicator-based detection and takedown attempts.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026