ChainScript RAT Uses Polygon Blockchain for C2 Discovery

Blackpoint’s Adversary Pursuit Group (APG) has uncovered ChainScript, a previously undocumented Node.js-based Remote Access Trojan (RAT). The malware is distributed through 'ClickFix' social engineering lures, where users are tricked into running malicious Windows Installers (MSIs) disguised as legitimate software like Spotify, Zoom, and Microsoft Teams. Once executed, the malware stages a Node.js runtime to run its core agent, facilitating extensive system control including interactive shells and file manipulation.

A defining characteristic of ChainScript is its use of the 'EtherHiding' technique for Command and Control (C2) resilience. The malware queries a Polygon smart contract to dynamically resolve its active WebSocket C2 address, allowing attackers to rotate backend infrastructure in real-time without updating the deployed agent. This decentralized approach complicates traditional indicator-based detection and takedown efforts by decoupling the malware from static infrastructure.

While currently observed targeting Windows via MSI packages, parallel campaigns (codenamed PasteSwitch) using similar ClickFix lures have been observed delivering macOS-specific threats like Atomic Stealer (AMOS) and MacSync. The adoption of legitimate development frameworks (Node.js) and blockchain-based discovery represents an emerging trend of modular, highly adaptable malware targeting both enterprise and cryptocurrency users.