ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
72
Malware
ChainScript
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 21, 2026
- Last mentionedSep 21, 2026
Timeline
2 articles · newest firstClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint details new ChainScript RAT spread via ClickFix lures that uses a Polygon smart contract to rotate C2 infrastructure.
65
Appears with
- Node.jsproduct · 2
- Blackpointvendor · 2
- Spotifyproduct · 2
- Microsoft Teamsproduct · 2
- Zoom Workplaceproduct · 2
- Cato Networksvendor · 1
- Amatera Stealermalware · 1
- HBO Maxproduct · 1
- Hudson Rockvendor · 1
- ZigClippermalware · 1
- Microsoftvendor · 1
- ClickFixmalware · 1
- Adversary Pursuit Grouporganization · 1
- Threat Actorthreat actor · 1
- AnimateClippermalware · 1
- Blackpointorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.