ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

A Full-Featured RAT Hiding Behind Fake Software Fixes

Researchers have documented a previously undocumented remote access trojan called ChainScript, delivered through ClickFix-style social engineering lures. ChainScript is written in JavaScript and runs on Node.js, and researchers describe it as providing "extensive remote access" — interactive CMD and PowerShell shells, file operations, screenshot capture, additional payload deployment, cryptocurrency wallet enumeration, and arbitrary remote JavaScript execution.

The infection chain starts with a ClickFix lure directing victims to a malicious Windows installer — observed as ComponentTask33-4d14e6ac.msi — executed via the legitimate msiexec.exe binary to blend in with normal installation activity. Hidden PowerShell and VBScript stages then deploy a Node.js runtime and launch ChainScript itself, with components dropped across %LOCALAPPDATA% paths deliberately named to mimic Microsoft branding.

Blockchain-Based Command and Control

The most notable aspect of the campaign is its C2 resolution mechanism. Rather than hardcoding command-and-control domains or IPs into the malware — infrastructure that gets sinkholed or blocklisted quickly — ChainScript uses an EtherHiding-style technique, resolving its actual backend infrastructure through a smart contract deployed on the Polygon blockchain.

"By separating backend discovery from the malware itself and using the Polygon contract as an external resolver, the operator can redirect infected hosts to new infrastructure while retaining the same implant."

This means operators can rotate C2 servers at will simply by updating the contract's state — no need to recompile or redistribute the malware, and no static domain/IP indicator for defenders to block long-term. Blockchain-based C2 resolution is difficult to take down through conventional means (domain seizure, hosting takedown) since the resolver itself lives on a decentralized, immutable ledger.

Multiple Aliases, Multiple Disguises

ChainScript has been observed operating under several build names, suggesting active, iterative development rather than a single static release:

• ComponentTask33
• UpdateDigital
• HostShared
• OrchidViolet66

The malware impersonates legitimate, widely-installed software to blend into normal user behavior, with observed lures posing as Spotify, Zoom Workplace, and Microsoft Teams.

Part of a Broader ClickFix Wave

Researchers note ChainScript is running alongside related campaigns using similar social-engineering mechanics, including PasteSwitch — which was used to compromise HBO Max's Reddit account — and fake Codex download schemes targeting macOS users. ClickFix-style lures (fake "fix this error" prompts that trick users into running attacker-supplied commands themselves) have become one of the dominant initial-access techniques of 2026 precisely because they bypass most technical controls: the user, not an exploit, executes the payload.

Why This Matters

ChainScript's Polygon-based C2 resolution is a meaningful evolution in RAT design. Security teams that rely on domain/IP threat-intel feeds to block known C2 infrastructure will find that approach increasingly ineffective against implants that resolve their backend from an immutable, publicly-queryable smart contract rather than DNS. Detection needs to shift toward behavioral indicators — Node.js runtimes launched from %LOCALAPPDATA% by msiexec.exe-spawned scripts, unexpected outbound connections to blockchain RPC endpoints, and PowerShell/VBScript chains following a ClickFix-style "paste this to fix the error" prompt.

Recommendations

1. Block or alert on ClickFix-pattern prompts — any webpage or popup instructing a user to open Run/PowerShell and paste a command is a red flag regardless of the branding used
2. Monitor for Node.js execution from unexpected locations, particularly %LOCALAPPDATA% paths mimicking system components
3. Flag outbound traffic to blockchain RPC providers (Polygon and similar) from endpoints that have no legitimate business reason to interact with smart contracts
4. Restrict msiexec.exe to signed, expected installer sources where feasible via application control policy
5. Educate users on ClickFix specifically — this technique now spans multiple unrelated malware families (ChainScript, PasteSwitch, and others) precisely because it works

References

• The Hacker News — ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Related Reading

• LeakNet Ransomware Uses ClickFix, Deno Runtime in Stealthy Attacks
• DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials