ChainScript RAT Leverages Polygon for Resilient C2 Infrastructure
A new remote access trojan, ChainScript, is being distributed via ClickFix lures and utilizes blockchain technology on the Polygon network to rotate its command and control infrastructure, making it difficult to track.
Threat actors are employing sophisticated "ClickFix"-like lures to distribute a newly identified remote access trojan (RAT) named ChainScript. Researchers from Blackpoint Adversary Pursuit Group (APG) have observed ChainScript appearing under various disguises, including "ComponentTask33," "UpdateDigital," "HostShared," and "OrchidViolet66," while impersonating legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams.
ChainScript exhibits advanced capabilities, functioning as a full-featured RAT that grants operators extensive remote control over compromised systems. Its functionalities include interactive command prompt and PowerShell access, file manipulation, screenshot capture, payload deployment, and the enumeration of cryptocurrency wallets, including both desktop applications and browser extensions. Furthermore, it supports remote JavaScript execution, expanding its potential for malicious activities.
The attack chain commences with a "ClickFix" lure, which prompts the victim to download and execute a malicious Windows installer disguised as a familiar application. This installer, often named "ComponentTask33-4d14e6ac.msi," deploys the Node.js runtime and initiates the ChainScript JavaScript agent through a series of hidden PowerShell and VBScript stages. These scripts deposit various components, such as the runtime, agent source code, configuration files, and auxiliary binaries, into different directories within the user's local application data folder.
To ensure persistence, the ChainScript agent establishes a user-level presence by creating a scheduled task and, as a fallback, utilizing a Registry Run key. Once active, the malware establishes a WebSocket connection to its command and control (C2) server to receive further instructions, effectively giving the threat actor direct command over the infected machine. The RAT also possesses the capability to self-update and remove its persistence mechanisms.
A key innovation in ChainScript's operation is its use of an "EtherHiding-style" C2 discovery technique. This method leverages a smart contract on the Polygon blockchain to locate its active C2 infrastructure. By using the Polygon contract as an external resolver, attackers can redirect infected hosts to new C2 servers without altering the implant itself, thereby enabling seamless infrastructure rotation and complicating traditional detection methods based on indicators of compromise.
This approach reflects an emerging trend among threat actors who are increasingly adopting flexible, decentralized infrastructure to evade takedown efforts and maintain operational continuity. The separation of C2 discovery from the malware implant allows for greater resilience against security measures designed to disrupt C2 communications.
Recent related activity highlights the broader ecosystem of ClickFix-based attacks. Threat actors previously compromised HBO Max's official Reddit account to push malicious ads that delivered ClickFix attacks, infecting both Windows and macOS devices with information-stealing malware like MacSync and Atomic Stealer. This incident, codenamed PasteSwitch, underscores how compromised trusted accounts can be used to bypass user skepticism and distribute malware effectively.
The adoption of blockchain technology for C2 infrastructure, as seen with ChainScript and previously with the "EtherHiding" campaign, signifies a growing challenge for cybersecurity professionals. The decentralized and dynamic nature of these infrastructures makes them significantly more resilient to takedown operations, requiring new strategies for detection and mitigation.