ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
ChainScript RAT uses Polygon smart contracts for C2 infrastructure rotation.
Threat actors are using ClickFix lures to distribute a new remote access trojan (RAT) named ChainScript, which disguises itself as legitimate software like Spotify and Zoom. ChainScript employs a novel technique using Polygon smart contracts to discover and rotate its command-and-control (C2) infrastructure, making it harder to detect and takedown. This sophisticated approach allows for flexible C2 management and uninterrupted operations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Blackpoint?
Get an email when a new story names Blackpoint, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting ClickFix social engineering lures to trick users into installing ChainScript RAT, disguised as trusted applications like Spotify and Zoom. The malware leverages Polygon blockchain smart contracts as a decentralized C2 rotation mechanism, making traditional domain-based takedowns and blocklists ineffective. This represents a dangerous evolution in attacker infrastructure resilience, as blockchain transactions are immutable and cannot be easily disrupted by law enforcement or security vendors. The human element remains the critical entry point — users are manipulated into executing malicious payloads through convincing fake software prompts. Organizations that lack behavioral monitoring and endpoint detection will struggle to identify this threat before significant damage occurs.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ChainScript
- malware — ComponentTask33
- malware — UpdateDigital
- malware — HostShared
- malware — OrchidViolet66
- malware — MacSync
- malware — Atomic macOS Stealer (AMOS)
- malware — Amatera Stealer
- malware — AnimateClipper
- malware — ZigClipper