[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyHTC-sgWd77Wxfv-5PQu3G5oMqRTz7Ufs_7kqOoCwrk":3},{"article":4,"iocs":50,"watch_terms":61,"solutions":62,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"de85362c-fcf7-468a-bf48-cc410e9c0864","ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers","clickfix-attacks-spread-chainscript-rat-via-fake-spotify-and-teams-installers-0f88d5","Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.","Blackpoint Cyber has identified ChainScript, a Node.js remote access trojan (RAT), distributed through fake installers for Spotify, Zoom, and Microsoft Teams as part of a ClickFix campaign. The malware uses a Polygon smart contract to dynamically locate its command-and-control server, allowing attackers to change C2 destinations without updating the malware on infected systems. ChainScript provides extensive remote control capabilities and performs wallet discovery.","ChainScript RAT spreads via fake Spotify, Zoom, and Teams installers, using Polygon smart contracts for C2.","https:\u002F\u002Fhackread.com\u002Fclickfix-chainscript-rat-fake-spotify-teams-installers\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fclickfix-chainscript-rat-fake-spotify-teams-installers.jpg","2026-09-21T11:28:42+00:00","2026-09-22T00:00:25.884679+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Spotify","product",{"name":21,"type":19},"Zoom Workplace",{"name":23,"type":19},"Microsoft Teams",{"name":25,"type":26},"Node.js","technology",{"name":28,"type":26},"Polygon",{"name":30,"type":31},"ClickFix","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58],{"type":52,"value":53,"context":54},"domain","shift-api-control.com","Initial C2 domain resolved by Polygon smart contract.",{"type":52,"value":56,"context":57},"bedotiq.net","Subsequent C2 domain resolved by Polygon smart contract.",{"type":36,"value":59,"context":60},"ChainScript","Name of the Node.js RAT.",[18,21,23],{"controls":63,"vendors":151},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":123,"name":124,"problem":125,"products":126},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":169},"fake-app-installers-deliver-blockchain-powered-rat-via-clickfix-campaign","Fake App Installers Deliver Blockchain-Powered RAT via ClickFix Campaign","Users were tricked into downloading malicious fake installers for trusted applications like Spotify, Zoom, and Microsoft Teams, resulting in infection by the ChainScript RAT. The malware's use of a Polygon blockchain smart contract as a C2 locator is particularly dangerous because it makes traditional domain-based blocking and takedowns ineffective — the attacker can silently redirect communications without touching the malware itself. This attack exploits a fundamental gap in security awareness: users trusting unofficial sources for legitimate software. The inclusion of wallet discovery functionality also signals financial theft as a secondary objective, raising the stakes beyond simple remote access. Organizations must address both the human tendency to seek software from unverified sources and the technical blind spots created by novel C2 evasion techniques.",[157,158,159,160,161,162,163,164,165,166,167,168],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1566: Phishing (User Execution)","MITRE ATT&CK T1071: Application Layer Protocol (C2)","MITRE ATT&CK T1195: Supply Chain Compromise","GDPR Article 32: Security of Processing (for organizations handling personal data on affected systems)",{}]