New "ChainScript" RAT Surfaces in the Wild Utilizing Blockchain-Based C2 Discovery and ClickFix Lures

Threat actors are increasingly adopting advanced, decentralized infrastructure and deceptive social engineering tactics to evade detection, as demonstrated by a newly uncovered remote access trojan (RAT) known as ChainScript.

According to recent findings by researchers at the Blackpoint Adversary Pursuit Group (APG)—including Sam Decker, Andi Ursry, and Nevan Beal—this sophisticated malware has been spotted under various build names, such as ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. To trick victims into installing it, the operators disguise the malicious packages as legitimate and widely used software like Spotify, Zoom Workplace, and Microsoft Teams.

The emergence of ChainScript highlights a broader evolution in the threat landscape. Like several other malware families analyzed by security researchers in recent months, ChainScript employs an EtherHiding-style command-and-control (C2) discovery technique. Instead of hardcoding C2 servers or relying on standard domain generation algorithms, the malware utilizes a Polygon smart contract to locate its active WebSocket infrastructure.

Security analysts note that ChainScript is a full-featured RAT designed to give operators deep and persistent visibility into compromised environments. Its capabilities include interactive access to the Windows Command Prompt and PowerShell, comprehensive file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration targeting both desktop applications and browser extensions, and remote JavaScript execution.

Inside the Attack Chain and Decentralized Infrastructure

The attack vector typically begins with a ClickFix-style lure, which tricks users into downloading and executing a malicious Windows installer via "msiexec.exe." In observed cases, an installer named "ComponentTask33-4d14e6ac.msi," masquerading as the popular music streaming application Spotify, deploys the Node.js runtime and triggers the ChainScript JavaScript agent through a series of hidden PowerShell and VBScript stages.

During execution, the accompanying PowerShell script drops multiple essential components—including the runtime environment, the agent source code, configuration files, and auxiliary binaries—into discreet locations within the "%LOCALAPPDATA%" folder, mimicking standard Microsoft application paths. Meanwhile, a VBScript component acts as the primary launcher for the ChainScript ecosystem.

To maintain access, the running agent establishes user-level persistence by configuring a scheduled task backed up by a Registry Run key fallback. Once active, ChainScript connects to its C2 server via WebSockets, allowing the threat actor to issue direct commands and execute remote tasks. The embedded command set also equips the malware with self-updating capabilities and the ability to remove its own persistence mechanisms if necessary.

Security researchers emphasize that this methodology illustrates how modern threat actors are shifting toward flexible, decentralized infrastructures to resist traditional law enforcement and industry takedown efforts, thereby guaranteeing uninterrupted operations.

By separating the backend discovery mechanism from the core malware and leveraging an external blockchain contract as a resolver, operators can easily redirect infected hosts to entirely new infrastructure without needing to modify the implant or alter the underlying reconnection workflow. This approach effectively complicates traditional indicator-based detection strategies relied upon by many security operations centers.

ClickFix Lures Target Both Mac and Windows Users Through Compromised Accounts

The discovery of ChainScript coincides with a surge in sophisticated ClickFix campaigns impacting both Windows and macOS ecosystems across the globe. In a prominent recent incident, threat actors compromised the official Reddit account of HBO Max ("u/hbomax") and abused it to push malicious advertisements. These ads initiated ClickFix attacks aimed at delivering information-stealing malware to unsuspecting users.

Tracked as "PasteSwitch" by cybersecurity firms Hudson Rock and ADAMnetworks, the operation utilized the verified corporate profile to publish 108 malicious advertisements over a compressed 48-hour window. Although the precise mechanism by which the Reddit account was initially breached remains under investigation, the campaign successfully exploited user trust in verified entities to bypass initial skepticism.

On macOS systems, the PasteSwitch operation has been observed delivering payloads such as MacSync, the Atomic macOS Stealer (AMOS), and fake cryptocurrency wallet applications engineered to harvest user recovery phrases. Conversely, Windows-based victims have been targeted with Amatera Stealer alongside cryptocurrency clippers like AnimateClipper and ZigClipper.

Data compiled by Seqrite Labs indicates that MacSync infections have heavily concentrated in the United States, followed by the United Kingdom, Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands. Researchers note that these campaigns predominantly focus on geographic regions with high concentrations of enterprise macOS adoption, software development hubs, and active Web3 or cryptocurrency communities.

Similar social engineering techniques have appeared in alternative delivery vectors, such as a fake Codex download experience distributed through search engine results. This tactic steers visitors to fraudulent Google Sites pages, prompting macOS users to copy and paste a malicious command directly into their Terminal application, which ultimately triggers the execution of Atomic Stealer. Non-Mac visitors routed to the same pages are typically served a benign decoy site to reduce suspicion.

According to analysis from Cato Networks, the copied Terminal command initiates a shell-script loader containing an obfuscated data blob. The script decodes and evaluates this data to produce a secondary shell script, which logs the execution steps and pulls down the final Mach-O payload.

Cybersecurity analysts characterize these incidents as part of a pervasive trend where threat actors abuse trusted services, enterprise platforms, and large language model (LLM) shared chat utilities to disseminate fraudulent installation instructions. These methods frequently succeed in bypassing conventional browser warnings, URL inspection filters, and automated Safe Browsing heuristics.

Further compounding these challenges, Microsoft disclosed findings last month regarding a separate macOS ClickFix campaign that utilized a cluster of at least 250 look-alike domains to propagate MacSync and Atomic Stealer. According to Microsoft’s telemetry, the campaign evolved from broadcasting broad ClickFix lures to implementing server-side browser-fingerprinting gates. This cloaking mechanism ensures that the malicious lure is displayed exclusively to visitors whose digital environments align with genuine macOS web browsers, actively evading web crawlers, security sandboxes, and automated analysis systems.