ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers

Users were tricked into downloading malicious fake installers for trusted applications like Spotify, Zoom, and Microsoft Teams, resulting in infection by the ChainScript RAT. The malware's use of a Polygon blockchain smart contract as a C2 locator is particularly dangerous because it makes traditional domain-based blocking and takedowns ineffective — the attacker can silently redirect communications without touching the malware itself. This attack exploits a fundamental gap in security awareness: users trusting unofficial sources for legitimate software. The inclusion of wallet discovery functionality also signals financial theft as a secondary objective, raising the stakes beyond simple remote access. Organizations must address both the human tendency to seek software from unverified sources and the technical blind spots created by novel C2 evasion techniques.