ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
72
Organization
Adversary Pursuit Group
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenSep 21, 2026
- Last mentionedSep 21, 2026
Timeline
1 articles · newest firstAppears with
- ClickFixmalware · 1
- Threat Actorthreat actor · 1
- Zoom Workplaceproduct · 1
- Node.jsproduct · 1
- Polygonproduct · 1
- Blackpointorganization · 1
- Spotifyproduct · 1
- ChainScriptmalware · 1
- Microsoft Teamsproduct · 1
- Blackpointvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.