ChainScript RAT Turns Polygon Smart Contracts Into a Movable C2 Directory

Fake software installers open the Windows attack chain

Threat actors are using ClickFix-style social engineering to install a previously undocumented Windows remote access trojan called ChainScript. The malware gives operators interactive access to infected systems while using the Polygon blockchain to locate replaceable command-and-control infrastructure.

Blackpoint Adversary Pursuit Group identified four ChainScript build names:

• ComponentTask33
• UpdateDigital
• HostShared
• OrchidViolet66

The builds masquerade as software associated with Spotify, Zoom Workplace, and Microsoft Teams. One observed Spotify-themed installer is named ComponentTask33-4d14e6ac.msi.

The legitimate applications are being impersonated; no vulnerability in Spotify, Zoom Workplace, Microsoft Teams, Node.js, or Windows has been identified in connection with this campaign. There is consequently no affected-version range, CVE identifier, CVSS score, or vendor patch.

Instead, the intrusion depends on persuading a victim to download and run an MSI package through msiexec.exe. This follows the familiar ClickFix model: a web page presents a fabricated problem or installation requirement and instructs the user to perform an action that executes attacker-supplied code.

The ChainScript-specific findings, including its installer chain and Polygon-based resolver, are attributed to Blackpoint APG’s technical reporting.

Node.js, PowerShell and VBScript conceal the implant

After execution, the malicious MSI installs the Node.js runtime and places several components in Microsoft-looking directories beneath %LOCALAPPDATA%. These files include the ChainScript JavaScript agent, configuration material and auxiliary binaries.

The deployment chain then uses concealed PowerShell and VBScript stages. VBScript operates as the main launcher for the JavaScript agent, which runs through the installed Node.js environment.

This approach gives the operation several opportunities to blend into normal system activity. MSI packages are common enterprise deployment mechanisms, PowerShell is a standard administrative tool, and Node.js may already be present on development workstations. The suspicious pattern emerges from their sequence and location rather than from any one executable.

Once launched, ChainScript establishes user-level persistence through a scheduled task. It also maintains a Registry Run key as a fallback, providing another path for execution when the user signs in.

The available reporting does not disclose the scheduled-task name, Registry value name, installed filenames, file hashes or exact %LOCALAPPDATA% paths. Defenders therefore cannot depend on a complete set of static host indicators.

A useful behavioral sequence to investigate is:

1. A recently downloaded MSI starts through msiexec.exe.
2. The installer writes a Node.js runtime and JavaScript files beneath a user profile.
3. PowerShell or VBScript launches from, or interacts with, those files.
4. A user-level scheduled task or Run key appears soon afterward.
5. Node.js establishes an outbound WebSocket connection.

That chain is considerably more distinctive than any individual component.

Polygon acts as a directory for replaceable C2 servers

ChainScript’s defining feature is its EtherHiding-style C2 discovery process. The implant does not rely exclusively on a server address permanently embedded in its code. Instead, it queries a Polygon smart contract to learn where its active WebSocket command-and-control server is located.

The connection process has four main stages:

1. ChainScript contacts the relevant Polygon contract.
2. Contract-controlled data identifies the current WebSocket infrastructure.
3. The implant connects to that server.
4. The server provides commands and additional tasking.

An operator can change the resolution data to point infected machines toward replacement infrastructure. Existing implants can then reconnect without requiring a new malware build or another interaction with the victim.

This separation makes conventional blocking less durable. Taking down or denying access to one WebSocket host may disrupt operations temporarily, but the operator can redirect the malware if control of the contract-backed resolution process remains intact.

It also reduces the value of extracting one network address from a sample. Detection must account for the smart-contract lookup, the subsequent WebSocket session and the processes responsible for both activities.

No Polygon contract address, WebSocket hostname, IP address or cryptocurrency-wallet address has been made available. ChainScript is also not associated with a disclosed vulnerability or CISA Known Exploited Vulnerabilities catalog entry.

Remote access extends to screenshots, payloads and wallets

After reaching its server, ChainScript can open interactive Command Prompt and PowerShell sessions. This gives the operator hands-on control rather than limiting the malware to a predetermined set of automated theft functions.

Its supported commands include:

• Reading, writing and otherwise manipulating files
• Capturing screenshots
• Installing additional payloads
• Executing remotely supplied JavaScript
• Updating the implant
• Removing its persistence mechanisms
• Enumerating cryptocurrency wallets in desktop applications
• Enumerating cryptocurrency-wallet browser extensions

These capabilities create several possible consequences for victims. Operators can inspect local data, monitor on-screen activity, deploy other malware and use native shells to move beyond ChainScript’s built-in features.

Wallet discovery is particularly notable because it can identify high-value targets before follow-on theft. The reporting does not establish that every infected host suffered cryptocurrency theft, nor does it provide a victim count or geographic distribution for ChainScript.

ChainScript’s ability to remove persistence also complicates investigation. An operator could clean up selected artifacts while leaving other payloads behind. Finding and deleting the original MSI would therefore not establish that the system is safe.

ClickFix operators are also filtering macOS visitors

The Windows activity fits into a wider pattern of ClickFix operations that combine user-executed commands with infrastructure designed to frustrate automated analysis.

In a separate advisory published on August 5, 2026, Microsoft documented a macOS ClickFix campaign delivering MacSync and Atomic Stealer (AMOS). Microsoft did not independently document ChainScript or its Polygon resolver, but its findings show how ClickFix delivery sites can selectively reveal malicious content.

Microsoft identified more than 250 front-end domains during its tracking. Some used dictionary-style names containing file, while others omitted that token. Examples included filecopperbasket, applefilevault and cloudsendhub.

The infrastructure evolved from placing malicious instructions directly in page HTML to serving a lightweight JavaScript profiler. That code collected properties from navigator, screen, window, document, location and console, then supplemented them with WebGL hardware signals and checks involving timezone, iframe state and touch support.

Visitors resembling genuine Mac users could receive the malicious download lure. Crawlers, sandboxes and non-qualifying systems might instead see an empty page or an unrelated decoy.

One qualifying page at apricotfilepoint[.]com displayed a forged “Verified Publisher” badge and offered an obfuscated curl command. A different request to the same domain returned a fake Urban VPN Proxy page.

A single benign response is therefore weak evidence. Testing suspicious infrastructure from only one scanner or browser profile can miss selectively delivered ClickFix content.

Defenders should prioritize behavior over fixed indicators

Organizations can begin with the known installer name, ComponentTask33-4d14e6ac.msi, but should not assume every ChainScript build uses it. The other reported build names—ComponentTask33, UpdateDigital, HostShared and OrchidViolet66—provide additional hunting pivots.

Endpoint teams should correlate msiexec.exe, PowerShell, VBScript and Node.js activity, especially when the files involved reside under %LOCALAPPDATA%. Node.js processes launched from newly created user-profile directories deserve scrutiny if they open WebSocket connections or execute unfamiliar JavaScript.

Other priorities include:

• Reviewing recently created user-level scheduled tasks and Registry Run keys
• Inspecting unusual outbound WebSocket traffic
• Correlating Polygon smart-contract access with Node.js or scripting activity
• Monitoring access to browser-extension profiles and desktop-wallet data
• Searching for screenshot capture and remotely supplied JavaScript execution
• Preserving PowerShell, process-creation, task-scheduler and Registry telemetry

Users should be instructed not to paste commands into PowerShell, Command Prompt or macOS Terminal because a website claims that verification, installation or troubleshooting requires it.

There is no dedicated ChainScript removal utility. A suspected endpoint should be isolated and investigated for the complete execution chain, persistence entries and secondary payloads—not merely the initial MSI. Static C2 blocking alone is unlikely to be sufficient because the implant’s Polygon-based resolver was designed to outlive individual backend servers.