ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
72
Product
Polygon
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenAug 11, 2026
- Last mentionedSep 21, 2026
Timeline
4 articles · newest firstThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.
55
ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain
A ClickFix social engineering campaign compromised 31 organizations, abusing the Polygon blockchain via EtherHiding for dynamically updated command-and-control.
60
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
62
Appears with
- Palo Alto Networks Unit 42vendor · 1
- Zoom Workplaceproduct · 1
- Cisco Talosvendor · 1
- AnyDeskvendor · 1
- ShinyHuntersthreat actor · 1
- Shadowserver Foundationvendor · 1
- iVerifyvendor · 1
- Spotifyproduct · 1
- Lynxthreat actor · 1
- ReliaQuestorganization · 1
- Blackpointvendor · 1
- JWRmalware · 1
- Blackpointorganization · 1
- Sessionproduct · 1
- Dysphoriamalware · 1
- Group-IBorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.