ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
72
Product
Zoom Workplace
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenAug 11, 2026
- Last mentionedSep 21, 2026
Timeline
4 articles · newest firstClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint details new ChainScript RAT spread via ClickFix lures that uses a Polygon smart contract to rotate C2 infrastructure.
65
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client
A Security researchers disclosed three Zoom annotation flaws enabling zero-click client hijacking; Zoom shipped fixes in June and July with no exploitation reported.
72
Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution
Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.
70
Related CVEs
by mentions- CVE-2026-534136%8.3Out-of-Bounds Write in Zoom Clients Enables Participant-to-Participant RCE
- CVE-2026-53415<1%8.3Use-After-Free in Zoom Client Annotator Enables Participant-to-Participant RCE
- CVE-2026-53414<1%6.5Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on…
Appears with
- Node.jsproduct · 2
- Spotifyproduct · 2
- A Securityorganization · 2
- ChainScriptmalware · 2
- Microsoft Teamsproduct · 2
- Blackpointvendor · 2
- Zoomvendor · 2
- Cato Networksvendor · 1
- Amatera Stealermalware · 1
- HBO Maxproduct · 1
- Hudson Rockvendor · 1
- ZigClippermalware · 1
- Microsoftvendor · 1
- ClickFixmalware · 1
- Adversary Pursuit Grouporganization · 1
- Threat Actorthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.