Full Report
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)
Analysis Summary
# Tool/Technique: ChainScript RAT
## Overview
ChainScript is a previously undocumented, full-featured Remote Access Trojan (RAT) written in JavaScript and executed via the Node.js runtime. It is characterized by its use of "EtherHiding" techniques, leveraging blockchain infrastructure (specifically Polygon smart contracts) for decentralized Command and Control (C2) discovery. This allows the malware to rotate infrastructure dynamically to evade traditional IP/domain-based blocking and takedown efforts.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Windows (utilizes Node.js runtime)
- **Capabilities:** Remote command execution (CMD/PowerShell), file system manipulation, screenshot capture, credential/wallet theft, and decentralized C2 resolution.
- **First Seen:** September 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link (ClickFix lures)]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.005 - Command and Scripting Interpreter: Visual Basic]
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1564.001 - Hide Artifacts: Hidden Files and Directories]
- [T1218.007 - System Binary Proxy Execution: Msiexec]
- **[TA0011 - Command and Control]**
- [T1102.003 - Web Service: One-Way Communication to Cloud Service (Blockchain/Polygon)]
- [T1071.001 - Application Layer Protocol: Web Protocols (WebSockets)]
## Functionality
### Core Capabilities
- **Interactive Shell:** Provides operators with direct access to CMD and PowerShell.
- **File Operations:** Ability to upload, download, and delete files on the victim machine.
- **Information Gathering:** Enumeration of cryptocurrency wallets (both desktop applications and browser extensions).
- **Surveillance:** Capture of system screenshots.
- **Payload Deployment:** Ability to drop and execute additional malicious binaries.
### Advanced Features
- **Blockchain C2 Discovery:** Uses a Polygon smart contract as an external resolver to locate active WebSocket C2 infrastructure, facilitating rapid infrastructure rotation.
- **Self-Maintenance:** Includes built-in commands for self-updating the agent code and removing persistence for clean uninstallation.
- **Hybrid Scripting:** Utilizes a chain of hidden PowerShell and VBScript stages to deploy the Node.js environment and the final JavaScript agent.
## Indicators of Compromise
- **File Hashes:**
- `ComponentTask33-4d14e6ac.msi` (SHA256: Refer to Blackpoint APG report for specific hash strings)
- **File Names:**
- `ComponentTask33`
- `UpdateDigital`
- `HostShared`
- `OrchidViolet66`
- `msiexec.exe` (Abused legitimate process)
- **Registry Keys:**
- Persistence established via Registry Run keys (fallback to Scheduled Tasks).
- **Network Indicators:**
- Polygon Smart Contract addresses (used for C2 resolution).
- WebSocket connections (C2 communication).
- **Behavioral Indicators:**
- `msiexec.exe` spawning PowerShell or VBScript.
- Unexpected Node.js runtime installation in `%LOCALAPPDATA%`.
- Scheduled tasks pointing to Node.js scripts in non-standard directories.
## Associated Threat Actors
- **Note:** While specific group names were not identified, the techniques (ClickFix, EtherHiding) are frequently associated with financially motivated cybercrime groups and "PasteSwitch" operations.
## Detection Methods
- **Signature-based:** Detection of the Node.js agent source code and the specific VBS/PowerShell launcher scripts.
- **Behavioral Detection:** Monitoring for `msiexec` calls that fetch remote files, and identifying unusual WebSocket traffic originating from Node.js processes on workstations.
- **Blockchain Monitoring:** Tracking transactions or data updates on the specific Polygon smart contracts used by the malware.
## Mitigation Strategies
- **Prevention:** Block known ClickFix lure domains and implement strict execution policies for Windows Installer (`.msi`) files.
- **Hardening:** Disable or restrict the use of Windows Script Host (VBScript) and PowerShell for standard users.
- **Environment:** Audit the `%LOCALAPPDATA%` directory for unauthorized software runtimes like Node.js.
- **User Training:** Educate users on the "ClickFix" social engineering tactic (e.g., fake "Fix It" buttons on browser error pages).
## Related Tools/Techniques
- **EtherHiding:** The underlying technique of using blockchain to hide C2 addresses.
- **ClickFix:** The social engineering framework used to deliver the initial payload.
- **PasteSwitch:** An associated operation abusing Reddit ads to deliver various stealers (MacSync, AMOS, etc.).
- **Amatera Stealer / AnimateClipper:** Other malware often delivered via similar infection chains.