Researchers at Blackpoint Adversary Pursuit Group have documented a previously undisclosed remote access trojan called ChainScript that borrows a page from cryptocurrency malware: instead of hardcoding a command-and-control (C2) server address, the implant queries a Polygon blockchain smart contract to find its active infrastructure. The technique — known as EtherHiding — means that even if defenders identify and block the C2 servers, the attacker can redirect all infected machines to new servers by updating a single on-chain record, leaving the malware itself untouched.
ChainScript has surfaced under at least four internal build names (ComponentTask33, UpdateDigital, HostShared, OrchidViolet66) and disguises its installer as Spotify, Zoom Workplace, or Microsoft Teams. The attack begins with a ClickFix lure — a fake browser prompt or download page that tricks users into running a Windows installer via msiexec.exe. That installer deploys the Node.js runtime alongside the ChainScript JavaScript agent through hidden PowerShell and VBScript stages, dropping components into Microsoft-looking paths in %LOCALAPPDATA%. The malware then establishes persistence via a scheduled task and a Registry Run key fallback, connects to its C2 over WebSockets, and awaits operator commands. Its full feature set includes interactive CMD and PowerShell access, file operations, screenshot capture, payload deployment, JavaScript execution, and enumeration of cryptocurrency wallets in both desktop apps and browser extensions.
The Blackpoint disclosure coincides with a separate but related ClickFix wave called PasteSwitch, in which attackers took over HBO Max’s verified Reddit account and ran 108 malicious ads over 48 hours in mid-September. Those ads distributed MacSync and Atomic macOS Stealer on Mac, and Amatera Stealer with crypto-clippers (AnimateClipper, ZigClipper) on Windows. The verified account status helped the malicious ads bypass initial user skepticism.