ChainScript RAT resolves its command channel through a Polygon smart contract
Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.
The Watch · Security desk
What happened
- Blackpoint Adversary Pursuit Group researchers Sam Decker, Andi Ursry and Nevan Beal documented ChainScript, a previously undocumented remote access trojan delivered through ClickFix-style lures.
- The implant has shipped under build names including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66, and presents itself as Spotify, Zoom Workplace and Microsoft Teams software.
- Instead of a fixed server address, ChainScript uses an EtherHiding-style technique that queries a Polygon smart contract to find the operator's currently active WebSocket infrastructure.
- Operator functions include interactive CMD and PowerShell, file operations, screenshots, payload deployment, remote JavaScript execution and enumeration of wallets in desktop apps and browser extensions.
Why it matters
- What it limits constraint Indicator lists for the WebSocket tier hold only until the operator updates the contract, so blocklist maintenance and takedown requests buy less time per hour spent than detection tuned to msiexec, PowerShell and script-host behaviour.
- Who's exposed exposure Persistence is user level, so any employee who can run an installer can host a permanent implant without a privilege escalation step or an administrator credential in play.
- What's now possible capability Wallet enumeration across desktop applications and browser extensions plus remote JavaScript execution gives the operator a same-session path to cryptocurrency theft on a machine the user believed was installing Spotify.
- What it sets up precedent Advice to distrust sketchy-looking ads loses force when the ad runs from a verified corporate account, which pushes the burden back onto endpoint controls and platform-side ad review.
Next story · Security · Oct 6
Fake Cloudflare checks on more than 100 hacked sites trick Ukrainians into installing Lunex StealerConfirmed3 publishers
Blackpoint described the design in its own words. "By separating backend discovery from the malware itself and using the Polygon contract as an external resolver, the operator can redirect infected hosts to new infrastructure while retaining the same implant and reconnect workflow," the company said [10]. The researchers place it in a wider trend: "ChainScript reflects an emerging pattern of malware using development frameworks and blockchain-based C2 discovery to enable infrastructure rotation and complicate traditional indicator-based detection" [9].
The WebSocket tier is therefore cheap for the operator to change. A domain or address list for it is accurate until the operator writes a new value into the contract [3], and the lookup itself has no registrar or hosting provider to serve with a takedown notice.
The execution chain does not rotate the same way. msiexec.exe runs an installer named ComponentTask33-4d14e6ac.msi that presents itself as Spotify, drops the Node.js runtime, and launches the JavaScript agent through hidden PowerShell and VBScript stages [5]. The PowerShell stage writes the runtime, the agent source, the configuration and auxiliary binaries into Microsoft-looking paths under %LOCALAPPDATA%, and the VBScript is the launcher [6]. The agent then keeps itself alive with a user-level scheduled task, falling back to a Registry Run key [7]. Each of those is a sequence a defender can watch for: msiexec fetching a remote package, PowerShell writing node.exe into a user profile directory, a script host opening a WebSocket.
The front end of these campaigns is working well enough to justify the engineering. Threat actors ran 108 malicious ads from HBO Max's verified Reddit account over 48 hours in mid-September 2026 [12], a rate of about 2.25 an hour sustained for two days [20]. On macOS the pages delivered MacSync, Atomic macOS Stealer and fake wallet applications built to capture recovery phrases; on Windows, Amatera Stealer plus the AnimateClipper and ZigClipper clippers [13]. Hudson Rock, which named the activity PasteSwitch together with ADAMnetworks [11], said: "By hijacking a verified corporate account, they bypassed the initial skepticism many users apply to internet advertisements" [15]. How the account was taken over, and how many people were infected, is not known [14].
A separate ClickFix run uses a fake Codex download surfaced through search results, sending macOS visitors to Google Sites pages that instruct them to paste a command into Terminal, which executes Atomic Stealer; visitors on other platforms get a harmless decoy page [18]. Seqrite Labs puts MacSync infections heaviest in the United States, then the United Kingdom, Germany, Japan, Canada, France, Singapore, Australia, India and the Netherlands [16]. "MacSync campaigns primarily target regions with widespread macOS enterprise use, tech and software development sectors, and active cryptocurrency or Web3 communities," researcher Chandra Kant Bauri said [17].
Every infected host has to read the same contract [3]. That makes the contract address the most stable value in the whole chain, and the published account of the research does not include it, nor a count of ChainScript infections [21].
What to watch
- Publication of the Polygon contract address and the endpoint values written to it, which would let defenders watch rotation instead of chasing expired addresses.
- Whether other malware families adopt the same on-chain resolver pattern on other blockchains, as Blackpoint expects.
- Any account from Reddit or HBO Max explaining how the verified u/hbomax account was taken over.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Blackpoint Adversary Pursuit Group (APG) researchers Sam Decker, Andi Ursry and Nevan Beal documented a previously undocumented remote access trojan called ChainScript, delivered using ClickFix-like lures.
- [2]
"ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint researchers said.
- [3]
ChainScript employs an EtherHiding-style command-and-control discovery technique that uses a Polygon smart contract to locate its active WebSocket infrastructure.
- [4]
ChainScript provides interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration covering both desktop apps and browser extensions, and remote JavaScript execution.
- [5]
The attack chain starts with a ClickFix lure leading to download and execution of a malicious Windows installer using msiexec.exe; the installer, ComponentTask33-4d14e6ac.msi, is disguised as Spotify, deploys the Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages.
- [6]
The PowerShell script drops the runtime, agent source, configuration and other auxiliary binaries across different Microsoft-looking paths in the %LOCALAPPDATA% folder, and the VBScript serves as the main launcher for ChainScript.
- [7]
The running agent establishes user-level persistence through a scheduled task with a Registry Run key fallback, then connects to the C2 server over WebSockets and retrieves additional tasking.
- [8]
ChainScript's supported commands also allow it to self-update and remove persistence.
- [9]
"ChainScript reflects an emerging pattern of malware using development frameworks and blockchain-based C2 discovery to enable infrastructure rotation and complicate traditional indicator-based detection," Blackpoint said.
- [10]
"By separating backend discovery from the malware itself and using the Polygon contract as an external resolver, the operator can redirect infected hosts to new infrastructure while retaining the same implant and reconnect workflow," Blackpoint said.
- [11]
Threat actors compromised HBO Max's official Reddit account (u/hbomax) and abused it to push malicious ads that launched ClickFix attacks against Windows and macOS devices with information-stealing malware; Hudson Rock and ADAMnetworks codenamed the activity PasteSwitch.
- [12]
The verified Reddit account served 108 malicious ads over a 48-hour period in mid-September 2026.
- [13]
On macOS, PasteSwitch delivered MacSync, Atomic macOS Stealer (AMOS) and fake cryptocurrency wallet applications designed to steal recovery phrases; the Windows branch distributed Amatera Stealer and the AnimateClipper and ZigClipper cryptocurrency clippers.
- [14]
It is not known how the HBO Max Reddit account was breached, how many people clicked the fake ads, or how many were compromised as a result.
- [15]
"By hijacking a verified corporate account, they bypassed the initial skepticism many users apply to internet advertisements," Hudson Rock said.
- [16]
According to data shared by Seqrite Labs, MacSync infections have concentrated in the U.S., followed by the U.K., Germany, Japan, Canada, France, Singapore, Australia, India and the Netherlands.
- [17]
"MacSync campaigns primarily target regions with widespread macOS enterprise use, tech and software development sectors, and active cryptocurrency or Web3 communities," researcher Chandra Kant Bauri said.
- [18]
Another ClickFix campaign uses a fake Codex download experience surfaced via search results to lead users to bogus Google Sites pages and trick macOS users into pasting a malicious command into Terminal, executing Atomic Stealer; visitors using non-Mac devices are served a harmless decoy page.
- [19]
A user-level scheduled task with a Registry Run key fallback survives reboot without administrator privileges, so a standard user account is sufficient for ChainScript to persist.
- [20]
108 ads over 48 hours is a rate of about 2.25 malicious ads per hour.
- [21]
The published account of Blackpoint's research does not include the Polygon contract address or a count of ChainScript infections.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comChainScript: the RAT that hides its command server inside a blockchain contract
1 article · September 21, 2026
- thehackernews.comClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
2 articles · September 21, 2026
Topics and entities
Entities
- Cato Networks
- Node.js
- MacSync
- Polygon
- Atomic macOS Stealer
- Hudson Rock
- HBO Max