Press play to start listening
Cybersecurity researchers at Blackpoint Cyber have identified a Node.js remote access trojan (RAT) called ChainScript while investigating a ClickFix campaign that used a fake Spotify installer to infect Windows users.
The company’s Adversary Pursuit Group (APG) found that ChainScript gives attackers remote control of infected systems and uses a Polygon smart contract to locate its command-and-control (C2) server.
ClickFix Delivers the ChainScript RAT
The research, shared with Hackread.com, reveals that the attack starts with ClickFix instructions that persuade a victim to run a command through Windows tools. The command uses msiexec.exe to retrieve ComponentTask33-4d14e6ac.msi from attacker-controlled infrastructure.
The MSI presents itself as Spotify software and launches hidden PowerShell and VBScript stages that install a bundled Node.js runtime and the ChainScript agent.
ChainScript establishes persistence through a scheduled task named ComponentTask33Agent, with a Windows Run key used as a fallback. Once running, the RAT gives attackers broad control of the system, including interactive CMD and PowerShell sessions, file browsing and transfer, screenshots, payload execution, updates, and remote JavaScript execution.
It also performs wallet discovery by identifying installed desktop wallets and browser wallet extensions. Blackpoint did not find dedicated functionality for stealing seed phrases, private keys, browser passwords, or cookies, although the RAT’s command and file-access capabilities could allow an operator to collect data manually.
Polygon Smart Contract Controls C2
ChainScript’s most unusual feature is how it finds its C2 server. Instead of relying on a permanently embedded address, the malware queries a Polygon smart contract using an EtherHiding-style technique. The contract returns the WebSocket address currently used by the operators, which ChainScript then caches for five minutes.
APG confirmed the behavior through controlled analysis of the live ChainScript infrastructure. The contract initially directed the agent to shift-api-control.com:3847. After the connection was reset, the same contract returned bedotiq.net:3854, showing how the operators can move the C2 service without changing the malware already installed on a victim’s computer.
Research published on GitHub by Justice-Hammer found that the resolver contract was deployed only 23 seconds before the analyzed MSI was built on August 24, 2026. The timing strongly suggests that contract deployment may be automated as part of the malware build process, although it does not by itself prove full automation.
ChainScript Uses Multiple Software Disguises
The RAT appeared in several builds, including UpdateDigital, HostShared, and OrchidViolet66, with the latter two disguised as Zoom Workplace and Microsoft Teams. The findings add ChainScript to a growing set of malware using blockchain-based C2 discovery.
Similar blockchain-based C2 techniques have also been documented in EtherRAT and Tsundere, where blockchain infrastructure is used to help malware locate its C2 servers.
Because ChainScript relies on user execution rather than a software vulnerability, there is no CVE or affected software version to patch. Its risk comes from the combination of ClickFix social engineering and the RAT’s ability to give an attacker continuing access while allowing the C2 destination to change.
“ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain based infrastructure discovery. The Node.js agent gives operators interactive shell access, file management, screenshots, payload deployment, wallet discovery, remote JavaScript execution, and update capabilities, while the Polygon resolver provides a stable way for deployed agents to locate whichever WebSocket panel is active,” researchers explained in the blog post.
