ChainScript RAT uses Polygon blockchain for C2 discovery

A new remote access trojan (RAT) named ChainScript is being deployed using ClickFix lures to compromise systems. The malware masquerades as legitimate software, including Spotify, Zoom Workplace, and Microsoft Teams, to trick users into installation.

ChainScript utilizes an ‘EtherHiding-style’ technique that leverages a Polygon smart contract for command-and-control (C2) discovery. This method allows threat actors to rotate their WebSocket infrastructure, making traditional indicator-based detection difficult. Once active, the JavaScript agent provides extensive remote access, including file operations, screenshot capture, cryptocurrency wallet enumeration, and the ability to execute remote JavaScript or PowerShell commands.

The attack chain typically begins with a ClickFix lure that leads to a malicious Windows installer. This installer deploys the Node.js runtime and launches the ChainScript agent through hidden PowerShell and VBScript stages, establishing user-level persistence on the compromised device.