ChainScript RAT Uses Polygon Smart Contracts to Rotate Command Servers
A new remote access trojan leverages blockchain technology to hide its command-and-control infrastructure from takedown efforts.
Key points
- ChainScript is a new RAT that disguises itself as Spotify or Teams to gain user trust.
- It uses Polygon smart contracts to dynamically locate its command-and-control servers.
- The malware provides full remote access, including shell control and crypto wallet theft.
Cybersecurity researchers have identified a new remote access trojan named ChainScript that disguises itself as legitimate software like Spotify and Microsoft Teams. The malware is delivered through social engineering lures that trick users into executing a malicious installer, granting attackers full control over the victim's system.
According to Blackpoint Adversary Pursuit Group, ChainScript stands out by using a Polygon smart contract to locate its active command-and-control servers. This decentralized approach allows threat actors to rotate their infrastructure quickly, making it significantly harder for defenders to track and shut down the malicious network.
Malware disguises itself as common apps
The attack begins with a ClickFix-style lure, a technique that manipulates users into manually executing malicious code. In this specific campaign, the payload is delivered as a Windows installer file named ComponentTask33, which mimics the appearance of Spotify. Once executed, the installer deploys the Node.js runtime and launches the ChainScript agent through hidden PowerShell and VBScript stages.
The malware establishes persistence by creating scheduled tasks and registry keys, ensuring it restarts automatically after a reboot. It then connects to remote servers via WebSockets to receive instructions. The capabilities of ChainScript are extensive, including interactive command shells, file manipulation, screenshot capture, and the ability to enumerate cryptocurrency wallets on the victim's machine.
Blockchain hides the command center
The critical innovation in this malware family is its use of an EtherHiding-style command-and-control discovery technique. Instead of hardcoding a specific server address, the malware queries a smart contract on the Polygon blockchain to find its current active infrastructure. This acts as an external resolver, allowing operators to redirect infected hosts to new servers without updating the malware code itself.
Blackpoint notes that this separation of backend discovery from the implant complicates traditional detection methods. By using a public ledger to manage private infrastructure, threat actors can maintain uninterrupted operations even if individual servers are seized. This reflects a broader trend of malware adopting decentralized technologies to resist takedown efforts.
Widespread attacks target multiple platforms
The disclosure of ChainScript coincides with a separate campaign codenamed PasteSwitch, which abused HBO Max's official Reddit account to push malicious ads. These ads launched ClickFix attacks targeting both Windows and macOS devices. On Windows, the campaign distributed Amatera Stealer, while macOS victims faced threats like MacSync and fake cryptocurrency wallet apps designed to steal recovery phrases.
Data from Seqrite Labs indicates that MacSync infections have concentrated in the United States, followed by the UK, Germany, and Japan. Researchers suggest these campaigns target regions with high enterprise usage of macOS and active cryptocurrency communities. The use of highly polished assets to establish trust before delivering the payload highlights the increasing sophistication of these social engineering efforts.
