ChainScript: the RAT that hides its command server inside a blockchain contract
New Node.js RAT 'ChainScript' hides command server in Polygon smart contract, spreading via ClickFix campaigns with fake Spotify/Zoom installers.
Blackpoint's Adversary Pursuit Group discovered ChainScript, a previously undocumented Node.js remote access trojan (RAT) that uses EtherHiding techniques to conceal its command-and-control server within a Polygon blockchain smart contract. The malware spreads through ClickFix campaigns, tricking users into pasting commands that execute MSI installers disguised as legitimate software like Spotify, Zoom, and Microsoft Teams. Once installed, ChainScript provides operators with comprehensive access including interactive shell, file operations, screenshots, and cryptocurrency wallet reconnaissance.
- ChainScript is a Node.js RAT that uses Polygon blockchain smart contracts for command server discovery.
- Infection vector uses ClickFix social engineering to execute malicious MSI installers disguised as Spotify, Zoom, or Teams.
- Malware provides full interactive shell, file access, screenshots, and crypto wallet reconnaissance.
- Attacker can rotate command-and-control infrastructure by updating the smart contract without modifying malware.
- Blackpoint researchers observed live C2 rotation during analysis.
- ATT&CK
- T1204 User ExecutionT1059 Command and Scripting InterpreterT1572 Protocol TunnelingT1571 Non-Standard PortT1105 Ingress Tool Transfer
- Vendors
- Blackpoint
- Threat actors
- Threat Actor
- Malware
- ChainScriptClickFix
- Organizations
- BlackpointAdversary Pursuit Group
From the original article
4 min read at securityaffairs.com
Blackpoint uncovers ChainScript, a Node. js RAT that queries a Polygon smart contract to find and rotate its command server. Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.