Overview
- Blackpoint Adversary Pursuit Group disclosed ChainScript on Monday, September 21, 2026 after tracing a ClickFix campaign that delivered a previously undocumented Node.js remote access trojan.
- The malware is installed by a ClickFix-style lure that runs an MSI via msiexec.exe and uses hidden PowerShell and VBScript stages to launch a bundled Node.js runtime and the JavaScript agent.
- ChainScript queries a Polygon smart contract to ABI-decode a returned ws:// or wss:// string, caches that WebSocket address for five minutes, and Blackpoint observed the contract returning different C2 addresses over time to prove backend rotation.
- The agent offers interactive shells, file operations, screenshots, payload deployment, remote JavaScript execution, self-update and user‑level persistence, and it enumerates installed crypto wallets but shows no dedicated seed‑phrase exfiltration code in analyzed samples.
- Defenders are urged to watch process chains and behavior—for example msiexec → wscript → node.exe that issues blockchain RPCs then opens WebSocket connections—because infrastructure indicators will be short‑lived and harder to block; similar blockchain-based C2 techniques have appeared in EtherRAT and Tsundere and were linked to a separate PasteSwitch campaign that abused a verified Reddit account to push ClickFix lures.