[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBYb1Ob0ss_PaNX3JW6pnVzjrCXuHYBo7CRonMpXvkNw":3},{"article":4,"iocs":55,"watch_terms":81,"solutions":82,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"902a48d6-fba9-40f6-ba77-4087eeccf6fa","ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure","clickfix-lures-deploy-chainscript-rat-using-polygon-to-rotate-c2-infrastructure-5b62ce","Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. \"ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software,\" Blackpoint Adversary Pursuit Group (APG)","Threat actors are using ClickFix lures to distribute a new remote access trojan (RAT) named ChainScript, which disguises itself as legitimate software like Spotify and Zoom. ChainScript employs a novel technique using Polygon smart contracts to discover and rotate its command-and-control (C2) infrastructure, making it harder to detect and takedown. This sophisticated approach allows for flexible C2 management and uninterrupted operations.","ChainScript RAT uses Polygon smart contracts for C2 infrastructure rotation.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fclickfix-lures-deploy-chainscript-rat.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi-cgmwQRZh142Z19A3s7K7tpaXtsyy6Imy9cYGM7nFP1DAZoSK9gDw8T0dGXlkFWOGDFShJWMNjC7jbwoSvLokr1pX27u2B1SABpBL-aWtaXj2hYYrqVwTE7LpEDn_iIbRYCro8sH2hzAEsjHLGkpFqTjEKlFHi2o2pgacFJQvYkPDCKVEhkJgW8OWhpZA\u002Fs1600\u002Fpoly.jpg","2026-09-21T08:39:38+00:00","2026-09-21T10:00:32.187461+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Spotify","product",{"name":21,"type":19},"Zoom Workplace",{"name":23,"type":19},"Microsoft Teams",{"name":25,"type":26},"Polygon","technology",{"name":28,"type":19},"Node.js",{"name":30,"type":31},"Blackpoint","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59,62,64,66,68,71,73,76,79],{"type":36,"value":57,"context":58},"ChainScript","Previously undocumented remote access trojan (RAT)",{"type":36,"value":60,"context":61},"ComponentTask33","Build name for ChainScript RAT",{"type":36,"value":63,"context":61},"UpdateDigital",{"type":36,"value":65,"context":61},"HostShared",{"type":36,"value":67,"context":61},"OrchidViolet66",{"type":36,"value":69,"context":70},"MacSync","Malware distributed by PasteSwitch campaign on macOS",{"type":36,"value":72,"context":70},"Atomic macOS Stealer (AMOS)",{"type":36,"value":74,"context":75},"Amatera Stealer","Malware distributed by PasteSwitch campaign on Windows",{"type":36,"value":77,"context":78},"AnimateClipper","Cryptocurrency clipper malware distributed by PasteSwitch campaign on Windows",{"type":36,"value":80,"context":78},"ZigClipper",[30,18,21],{"controls":83,"vendors":171},[84,113,142],{"slug":85,"name":86,"problem":87,"products":88},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":143,"name":144,"problem":145,"products":146},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[147,155,163],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[],{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":187},"chainscript-rat-uses-blockchain-to-evade-c2-detection","ChainScript RAT Uses Blockchain to Evade C2 Detection","Threat actors are exploiting ClickFix social engineering lures to trick users into installing ChainScript RAT, disguised as trusted applications like Spotify and Zoom. The malware leverages Polygon blockchain smart contracts as a decentralized C2 rotation mechanism, making traditional domain-based takedowns and blocklists ineffective. This represents a dangerous evolution in attacker infrastructure resilience, as blockchain transactions are immutable and cannot be easily disrupted by law enforcement or security vendors. The human element remains the critical entry point — users are manipulated into executing malicious payloads through convincing fake software prompts. Organizations that lack behavioral monitoring and endpoint detection will struggle to identify this threat before significant damage occurs.",[177,178,179,180,181,182,183,184,185,186],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","MITRE ATT&CK T1566: Phishing \u002F Social Engineering","MITRE ATT&CK T1102: Web Service (C2 via legitimate services)","MITRE ATT&CK T1568: Dynamic Resolution (C2 infrastructure rotation)",{}]