ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint details new ChainScript RAT spread via ClickFix lures that uses a Polygon smart contract to rotate C2 infrastructure.
Blackpoint's Adversary Pursuit Group describes ChainScript, a previously undocumented full-featured RAT masquerading as Spotify, Zoom Workplace and Microsoft Teams installers. It uses an EtherHiding-style technique, querying a Polygon smart contract to locate active WebSocket C2 servers, letting operators rotate infrastructure while resisting takedowns. The chain starts with ClickFix lures leading to msiexec execution, Node.js runtime deployment and hidden PowerShell/VBScript stages, with scheduled-task and Registry Run key persistence. Separately, HBO Max's verified Reddit account served 108 malicious ads in 48 hours pushing MacSync, Atomic macOS Stealer, Amatera Stealer and crypto clippers.
- ChainScript masquerades as Spotify, Zoom Workplace and Microsoft Teams installers under multiple build names
- Polygon smart contract acts as external resolver for WebSocket C2 discovery, enabling infrastructure rotation
- Delivered via ClickFix lures through msiexec, hidden PowerShell and VBScript stages with Node.js agent
- RAT supports remote shell, file operations, screenshots, wallet enumeration and remote JavaScript execution
- HBO Max's verified Reddit account served 108 malicious ads pushing infostealers and clippers
- ATT&CK
- T1204.002 Malicious FileT1059.001 PowerShellT1059.005 Visual BasicT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
- Victims
- HBO Max
From the original article
3 min read at thehackernews.com
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.