ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers

Summary

Blackpoint Cyber has identified ChainScript, a Node.js remote access trojan (RAT), distributed through fake installers for Spotify, Zoom, and Microsoft Teams as part of a ClickFix campaign. The malware uses a Polygon smart contract to dynamically locate its command-and-control server, allowing attackers to change C2 destinations without updating the malware on infected systems. ChainScript provides extensive remote control capabilities and performs wallet discovery.

Full text

Security MalwareClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server. byDeeba AhmedSeptember 21, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Cybersecurity researchers at Blackpoint Cyber have identified a Node.js remote access trojan (RAT) called ChainScript while investigating a ClickFix campaign that used a fake Spotify installer to infect Windows users. The company’s Adversary Pursuit Group (APG) found that ChainScript gives attackers remote control of infected systems and uses a Polygon smart contract to locate its command-and-control (C2) server. ClickFix Delivers the ChainScript RAT The research, shared with Hackread.com, reveals that the attack starts with ClickFix instructions that persuade a victim to run a command through Windows tools. The command uses msiexec.exe to retrieve ComponentTask33-4d14e6ac.msi from attacker-controlled infrastructure. The MSI presents itself as Spotify software and launches hidden PowerShell and VBScript stages that install a bundled Node.js runtime and the ChainScript agent. ChainScript establishes persistence through a scheduled task named ComponentTask33Agent, with a Windows Run key used as a fallback. Once running, the RAT gives attackers broad control of the system, including interactive CMD and PowerShell sessions, file browsing and transfer, screenshots, payload execution, updates, and remote JavaScript execution. It also performs wallet discovery by identifying installed desktop wallets and browser wallet extensions. Blackpoint did not find dedicated functionality for stealing seed phrases, private keys, browser passwords, or cookies, although the RAT’s command and file-access capabilities could allow an operator to collect data manually. Polygon Smart Contract Controls C2 ChainScript’s most unusual feature is how it finds its C2 server. Instead of relying on a permanently embedded address, the malware queries a Polygon smart contract using an EtherHiding-style technique. The contract returns the WebSocket address currently used by the operators, which ChainScript then caches for five minutes. APG confirmed the behavior through controlled analysis of the live ChainScript infrastructure. The contract initially directed the agent to shift-api-control.com:3847. After the connection was reset, the same contract returned bedotiq.net:3854, showing how the operators can move the C2 service without changing the malware already installed on a victim’s computer. Research published on GitHub by Justice-Hammer found that the resolver contract was deployed only 23 seconds before the analyzed MSI was built on August 24, 2026. The timing strongly suggests that contract deployment may be automated as part of the malware build process, although it does not by itself prove full automation. ChainScript Uses Multiple Software Disguises The RAT appeared in several builds, including UpdateDigital, HostShared, and OrchidViolet66, with the latter two disguised as Zoom Workplace and Microsoft Teams. The findings add ChainScript to a growing set of malware using blockchain-based C2 discovery. Similar blockchain-based C2 techniques have also been documented in EtherRAT and Tsundere, where blockchain infrastructure is used to help malware locate its C2 servers. Because ChainScript relies on user execution rather than a software vulnerability, there is no CVE or affected software version to patch. Its risk comes from the combination of ClickFix social engineering and the RAT’s ability to give an attacker continuing access while allowing the C2 destination to change. “ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain based infrastructure discovery. The Node.js agent gives operators interactive shell access, file management, screenshots, payload deployment, wallet discovery, remote JavaScript execution, and update capabilities, while the Polygon resolver provides a stable way for deployed agents to locate whichever WebSocket panel is active,” researchers explained in the blog post. Deeba Ahmed Deeba is a veteran cybersecurity reporter at Hackread.com with over a decade of experience covering cybercrime, vulnerabilities, and security events. Her expertise and in-depth analysis make her a key contributor to the platform’s trusted coverage. View Posts ChainScriptClickFixCybersecurityMalwareRATSmart ContractWindows Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Cyber Attacks Qilin Ransomware Gang Claims 4TB Data Breach at Nissan CBI Qilin ransomware claims a 4TB data breach at Nissan CBI, leaking car design files, financial data, 3D models,… byWaqas Read More News Security Critical Amazon Ring Vulnerability Could Expose Camera Recordings The vulnerability was discovered by Atlanta-based app security firm Checkmarx while assessing the Ring doorbell app for Android. byDeeba Ahmed Read More Android Malware Security Arsink Spyware Posing as WhatsApp, YouTube, Instagram, TikTok Hits 143 Countries Another day, another Android malware campaign targeting unsuspecting users worldwide by masquerading as popular apps. byDeeba Ahmed Read More News Security FBI Hack – Agency Investigating Internal Network Breach The Federal Bureau of Investigation (FBI) is investigating an internal network breach caused by an isolated incident, which the agency claims is now contained. byHabiba Rashid

Indicators of Compromise

• domain — shift-api-control.com
• domain — bedotiq.net
• malware — ChainScript

Entities