> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure - URL: https://f4n6.co.uk/security-feed/clickfix-lures-deploy-chainscript-rat-using-polygon-to-rotate-c2-infrastructure/ - Published: 2026-09-21T15:03:54.000Z - Updated: 2026-09-21T15:03:54.000Z - Author: Jeff Davies - Tags: #security-feed, Blackpoint Adversary Pursuit Group ## 1\. Executive summary Threat actors are using ClickFix-style social engineering lures to deliver a previously undocumented remote access trojan that Blackpoint Adversary Pursuit Group (APG) calls ChainScript, distributed through malicious Windows installers disguised as Spotify, Zoom Workplace, and Microsoft Teams software. ChainScript is a full-featured RAT offering interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration across desktop apps and browser extensions, and remote JavaScript execution. Its command-and-control discovery uses an EtherHiding-style technique that reads a Polygon smart contract to locate active WebSocket infrastructure, which lets the operator rotate C2 endpoints without redeploying the implant. Attribution is unconfirmed: Blackpoint APG has no MITRE ATT&CK profile in our reference data, and the campaign's scale and victimology beyond the reported 31 organisations rest on single-source reporting. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The campaign is an active external threat that clients should hunt for, but no fact in the source material ties it to a specific incident, third-party relationship, or concentration exposure that would trigger a named article. Generic incident-readiness obligations apply to every threat and are not mapped here. ## 3\. Technical analysis & attack chain Confirmed attack chain, as reported by Blackpoint APG: 1. The victim encounters a ClickFix lure, a fake verification or error page that instructs them to manually copy and run a command or download a file to fix a supposed problem. 2. The lure leads to the download and execution of a malicious Windows installer via msiexec.exe. The reported sample is named ComponentTask33-4d14e6ac.msi and is disguised as Spotify. 3. The installer deploys the Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages. 4. The PowerShell script drops the runtime, agent source, configuration, and auxiliary binaries across Microsoft-looking paths inside %LOCALAPPDATA%. 5. The VBScript acts as the main launcher for ChainScript. 6. The running agent establishes user-level persistence through a scheduled task, with a Registry Run key as fallback. 7. ChainScript connects to its C2 server over WebSockets and retrieves tasking, giving the operator direct control of the host. Supported commands include self-update and removal of persistence. C2 discovery is the notable design choice. ChainScript uses an EtherHiding-style technique that queries a Polygon smart contract to resolve its active WebSocket C2 address, treating the blockchain as an attacker-controlled address book. Because backend discovery is separated from the implant, the operator can redirect infected hosts to new infrastructure while keeping the same implant and reconnect workflow. This defeats static C2 blocklists: the contract, not a hardcoded IP or domain, is the stable pivot. Dark Reading reports the campaign has compromised 31 organisations and abuses Polygon for this rotation; that figure is single-sourced. ChainScript's capabilities, per Blackpoint: interactive CMD and PowerShell execution, file operations, screenshot capture, additional payload deployment, cryptocurrency wallet enumeration covering both desktop applications and browser extensions, and remote JavaScript execution. The build names observed are ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, presented as Spotify, Zoom Workplace, and Microsoft Teams software. Context from related reporting, which is distinct from ChainScript: Elastic Security Labs documented a separate ClickFix campaign (MIMICRAT) that compromised legitimate websites including bincheck\[.\]io, a BIN validation service, to load a fake Cloudflare verification page that copies a PowerShell one-liner to the victim's clipboard. That chain uses ETW and AMSI bypass and a Lua-based shellcode loader, and its implant is a native C RAT, not a Node.js JavaScript agent. Huntress has documented related ClickFix campaigns using similar infrastructure. These are parallel operations in the same lure category; do not conflate MIMICRAT indicators with ChainScript. The primary source does not state which websites or ad networks delivered the ChainScript lure, so the initial delivery surface for this specific campaign is unknown. A second related operation, PasteSwitch (Hudson Rock and ADAMnetworks), compromised the HBO Max Reddit account u/hbomax to serve 108 malicious ads over 48 hours in mid-September 2026, delivering Amatera Stealer and cryptocurrency clippers on Windows and MacSync, Atomic macOS Stealer, and fake wallet apps on macOS. This is context on ClickFix's current reach, not part of the ChainScript chain. ## 4\. Mitigation & containment P1, within 24 hours: - Hunt for the reported installer name pattern: any msiexec.exe execution involving an installer matching ComponentTask33-\*.msi, or the build names UpdateDigital, HostShared, and OrchidViolet66 in file, process, or scheduled-task paths. The full sample hash is not in the source material, so hunt on names. - Search %LOCALAPPDATA% for unexpected Node.js runtime installations and JavaScript agent files in Microsoft-looking directory names. A Node.js runtime appearing in %LOCALAPPDATA% outside a legitimate application install is the campaign's signature footprint. - Audit scheduled tasks and Registry Run keys for entries that launch VBScript or PowerShell pointing into %LOCALAPPDATA%. Disable and delete any that match, then rebuild affected user profiles rather than trusting in-place cleanup, since the implant supports self-update. P2, within 72 hours: - Block WebSocket connections from user workstations to newly registered or uncategorised domains where policy allows, since ChainScript retrieves tasking over WebSockets. The Polygon-based resolver means domain and IP blocklists will not hold; egress control and behavioural detection are the durable controls. - Alert on wscript.exe or cscript.exe executing .vbs files from %LOCALAPPDATA%, and on powershell.exe spawned by msiexec.exe child processes. - Review any helpdesk or user reports from the past month describing verification prompts that asked them to paste or run a command, since ClickFix relies on the user executing the lure. P3, within 7 days: - Restrict msiexec.exe execution for standard users via AppLocker or WDAC policy, or require installer approval, so a socially engineered user cannot complete stage one. - Add user-awareness content covering ClickFix specifically: no legitimate Cloudflare, Spotify, Zoom, or Teams prompt asks the user to paste a command into Run or PowerShell. - If a compromise is confirmed, treat it as active remote access with wallet enumeration capability: rotate credentials and MFA secrets from a clean host, and check browser extension stores and desktop wallet applications for unauthorised access, since ChainScript enumerates both. ## 5\. Indicators of compromise The source material provides file names and build names but no hashes, domains, IPs, or the Polygon contract address. | type | value | confidence | source | | -------- | ---------------------------- | ---------- | --------------- | | filename | ComponentTask33-4d14e6ac.msi | high | The Hacker News | | filename | ComponentTask33 | high | The Hacker News | | filename | UpdateDigital | medium | The Hacker News | | filename | HostShared | medium | The Hacker News | | filename | OrchidViolet66 | medium | The Hacker News | ```iocs filename ComponentTask33-4d14e6ac.msi filename ComponentTask33 filename UpdateDigital filename HostShared filename OrchidViolet66 ``` Behavioural indicators: | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------ | ----------------------------------- | ---------- | | msiexec.exe installing a package that spawns hidden PowerShell and VBScript stages | EDR process tree | high | | Node.js runtime and JavaScript agent files dropped into Microsoft-looking paths under %LOCALAPPDATA% | endpoint file telemetry | high | | Scheduled task creation at user level with Registry Run key fallback | Windows event logs, EDR | high | | WebSocket connections to resolve C2 tasking, with the C2 address resolved via a Polygon smart contract query | egress proxy, DNS and TLS telemetry | medium | ## 6\. Detection ```yara rule ChainScript_ClickFix_Installer_Artefacts { meta: author = "Adverse Trace" date = "2026-09-21" reference = "https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html" description = "Detects ChainScript build names reported by Blackpoint APG in files, scheduled tasks, or dropped components" strings: $build1 = "ComponentTask33" ascii $build2 = "UpdateDigital" ascii $build3 = "HostShared" ascii $build4 = "OrchidViolet66" ascii condition: 2 of them } ``` ```yaml title: ChainScript persistence via scheduled task or Run key from LOCALAPPDATA id: 00000000-0000-0000-0000-000000000000 status: experimental description: Detects scheduled task or Registry Run key persistence that launches VBScript or PowerShell from %LOCALAPPDATA%, matching the ChainScript deployment pattern reported by Blackpoint APG. references: - https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html author: Adverse Trace date: 2026-09-21 logsource: product: windows category: process_creation detection: selection_task: Image|endswith: '\schtasks.exe' CommandLine|contains: - '/create' - '\LOCALAPPDATA%' selection_runkey: CommandLine|contains: - 'CurrentVersion\Run' - '\LOCALAPPDATA%' filter_launcher: Image|endswith: - '\wscript.exe' - '\cscript.exe' - '\powershell.exe' condition: (selection_task or selection_runkey) and 1 of filter_launcher* falsepositives: - Legitimate application installers that create scheduled tasks under the user profile level: high ``` ## 7\. Sources - The Hacker News, "ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure", https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html, 2026-09-21 - Dark Reading, "ClickFix Campaign Compromises 31 Orgs, Abuses Polygon Blockchain", https://www.darkreading.com/endpoint-security/clickfix-campaign-comprises-31-orgs-abuses-polygon-blockchain, 2026-09-21 - Elastic Security Labs, "MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites", https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks, 2026 ## 8\. Adverse Trace position We assess ChainScript as a capable, actively developed RAT whose Polygon-based C2 resolution makes indicator blocking unreliable and behavioural and egress controls the effective defence, and we assess the immediate risk to EMEA financial services as moderate: the lure category is opportunistic, but wallet enumeration and interactive shell access on an end-user workstation is a direct path to credential and payment-system exposure if that workstation has access to internal services. Attribution is unconfirmed, and the 31-organisation figure and the build-name set are single-sourced to Blackpoint APG and Dark Reading; verify against your own telemetry before enforcing on names alone. We will update this advisory when a sample hash, the Polygon contract address, or a second-source technical analysis becomes available, and we are monitoring the related MIMICRAT and PasteSwitch campaigns separately. --- [Read the original source →](https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*