New ChainScript RAT Exploits ClickFix Lures with Blockchain C2

• •ChainScript RAT uses ClickFix lures to infect Windows systems via malicious installers.
• •The malware employs blockchain technology for dynamic command-and-control server rotation.
• •Security teams should monitor for unusual process behaviors and educate users on social engineering.

A newly discovered Node.js remote access trojan (RAT) named ChainScript is being deployed through ClickFix social engineering tactics, targeting Windows systems. The malware utilizes a unique command-and-control (C2) discovery method by querying a Polygon blockchain smart contract to dynamically rotate its server addresses. Once executed, ChainScript can perform a variety of malicious activities, including file manipulation and cryptocurrency wallet reconnaissance. The attack vector begins with users being tricked into running a malicious installer disguised as legitimate software like Spotify. Analysts have observed multiple build names for ChainScript, indicating a diverse deployment strategy. The malware's ability to hide its C2 infrastructure complicates detection and response efforts. Current reports suggest that this malware is actively being used in the wild, raising concerns about its potential impact on organizations. Security teams are advised to monitor for unusual process activities and educate users on recognizing social engineering attempts.