ChainScript RAT: Multi-Staged Malware Using ClickFix Social Engineering and Polygon for C2 Infrastructure

ChainScript is a previously undocumented remote access trojan that has circulated under multiple build aliases, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. The malware uses convincing impersonations of legitimate software to deceive users into execution. Security researchers at Blackpoint Adversary Pursuit Group (APG) documented campaigns where ChainScript presented itself as Spotify, Zoom Workplace, and Microsoft Teams during the initial compromise stage.

The malware operates as a multi-staged infection chain. The first stage typically arrives through fake update prompts (the ClickFix attack pattern), which appear as system notifications warning of missing software components or critical updates. Users who click these notifications are directed to download what appears to be an installer but is actually the ChainScript dropper. Once executed, it deploys the full RAT payload onto the victim's machine, granting the attacker remote access to files, screen recording, keystroke capture, and command execution capabilities.

ClickFix lures have become a standard delivery mechanism for modern malware because they exploit legitimate user behavior: the expectation that software occasionally needs updates. ChainScript campaigns abuse this pattern by creating fake "fix" or "update" prompts that look identical to operating system notifications. The visual authenticity is crucial to success, since users are conditioned to trust system-level update dialogs.

The ClickFix variant used in ChainScript campaigns typically displays urgent language ("Critical component missing," "Your browser needs an update") and an action button that either downloads the trojan directly or redirects to a phishing page hosting the malware. These lures often target users who are already in a state of concern about their device or browsing experience, making them less likely to scrutinize the source of the notification.

What distinguishes ChainScript campaigns from earlier ClickFix attacks is the sophistication of the follow-up infrastructure, which uses decentralized technology to avoid detection once the initial foothold is established.

ChainScript's most novel feature is its use of the Polygon blockchain network to manage and rotate command-and-control (C2) server addresses. Instead of hardcoding C2 infrastructure or relying on traditional domain registration and DNS, the malware queries Polygon blockchain transactions to retrieve updated C2 endpoints. This approach complicates defensive measures because:

• C2 addresses change dynamically without relying on traditional domain infrastructure that security teams can monitor or block.
• Blockchain records are immutable and distributed, making it difficult to remove or alter C2 configuration data once deployed.
• Detection of C2 communication requires monitoring blockchain transactions in real time, a capability most organizations lack.

The use of Polygon specifically (a Layer 2 scaling solution for Ethereum) is likely chosen because it offers lower transaction costs than the main Ethereum network, making it affordable for threat actors to rotate C2 infrastructure frequently. This technique represents a shift in how sophisticated malware authors are adopting blockchain technology not for the sake of anonymity alone, but as an operational resilience mechanism.

According to security vendor incident reports and law-enforcement advisories, malware using blockchain-based C2 management remains relatively uncommon but is growing. The tactic requires victims to maintain internet connectivity for the malware to retrieve updated C2 addresses from the blockchain, which is why ChainScript typically includes secondary fallback mechanisms (alternative C2 servers or peer-to-peer communication channels) to maintain persistence if blockchain queries fail.

Organizations observing ChainScript infections typically notice lateral movement attempts, credential harvesting from browser caches, and deployment of secondary malware payloads (such as information stealers or cryptominers). The APG team noted that affected users saw unusual process execution patterns, elevated CPU usage, and outbound connections to Polygon RPC endpoints.

Effective defense against ChainScript involves multiple layers:

1. Block fake update prompts by disabling in-browser notifications for non-essential sites and educating users that legitimate updates arrive through settings menus, not pop-up alerts.
2. Monitor process execution for suspicious child processes spawned by browsers or legitimate-looking installers, particularly those that immediately connect to external infrastructure.
3. Log all outbound connections to Polygon RPC nodes and Ethereum-related IP addresses; these are rare in normal business traffic.
4. Isolate systems suspected of ChainScript infection immediately and conduct memory forensics to identify the C2 configuration stored in the running process.
5. Use endpoint detection and response (EDR) tools configured to alert on code injection patterns, unsigned executables masquerading as legitimate software, and reconnaissance activity immediately after system compromise.

Network-level detection is harder because blockchain queries use standard HTTPS traffic, requiring deep packet inspection or behavioral analysis to flag. Most organizations will rely on endpoint-level indicators and user reporting of suspicious update prompts.

ChainScript demonstrates that threat actors are not abandoning traditional infrastructure; instead, they are adding layers of evasion technology to existing attack patterns. The combination of social engineering (ClickFix lures), obfuscation (multiple build names and software impersonations), and decentralized C2 management represents a realistic operational model for campaigns targeting organizations that have already invested in network-level defenses.

Defense strategies that worked against earlier RAT campaigns may be insufficient against adversaries using blockchain infrastructure. Organizations that rely solely on domain blocklists, IP reputation feeds, or traditional C2 sinkholing will need to update their threat models to account for malware that updates its infrastructure through decentralized means.

The broader lesson is that as security tools improve, adversaries adopt technologies that security teams have not yet standardized monitoring for. Blockchain is one such frontier; it provides genuine operational advantages (low cost, distributed, persistent) while also being young enough that few organizations have mature detection rules for it.

If you manage systems in an organization, prioritize user security awareness training focused on fake update prompts and the fact that legitimate updates never come from in-browser notifications. Ensure your EDR and network monitoring tools are configured to log outbound connections to RPC nodes and blockchain infrastructure, even though this may generate false positives initially. If you suspect ChainScript infection on a device, isolate it from the network immediately, collect disk and memory forensics, and notify your security team. For personal users, keep software update prompts off by default in browser settings, install updates only through legitimate settings menus, and maintain current backups in case recovery from infection is necessary.

Source: The Hacker News