ClickFix Lures ChainScript RAT on Polygon to Rotate C2

What is ChainScript RAT?

ChainScript is a remote access trojan that first appeared in late 2023. It is delivered through phishing lures that mimic legitimate collaboration tools such as Spotify, Zoom Workplace, and Microsoft Teams. The malware has been observed under several build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. Security researchers at the Blackpoint Adversary Pursuit Group have confirmed that the payload is a fully functional RAT capable of keylogging, screen capture, file exfiltration and lateral movement.

How ClickFix Lures Operate

ClickFix is not a single piece of software but a campaign name used by multiple threat actors. The lures typically arrive as email attachments or malicious download links. Once a victim opens the attachment, a dropper extracts the ChainScript binary and executes it in the background. The dropper often disguises the executable with icons that match the claimed application, making visual detection difficult.

Common delivery vectors

• Email messages that claim a meeting invitation from Zoom Workplace.
• Fake software update notifications for Microsoft Teams.
• Social media posts offering premium Spotify playlists.

Why Polygon is Chosen for C2 Rotation

Polygon is a layer‑2 scaling solution for the Ethereum blockchain. Its low transaction fees and fast confirmation times make it attractive for malicious actors who need to hide command and control (C2) infrastructure. By publishing encrypted C2 addresses on the blockchain, attackers can change the location of their servers without updating the malware code on infected hosts.

Each time the RAT contacts the blockchain, it reads a small data payload that contains the next C2 endpoint. This technique, known as “blockchain‑based C2 rotation,” reduces the chance that defenders can sinkhole the malicious domain.

Technical steps used by the attackers

1. Generate a new C2 server address and store it in a smart contract on Polygon.
2. Encrypt the address with a symmetric key embedded in the RAT.
3. Publish the encrypted payload to the blockchain using a low‑cost transaction.
4. When the infected host runs, the RAT queries the contract, decrypts the address and establishes a connection.

Impact on Victims

Once a system is compromised, ChainScript provides the attacker with full control. The most reported impacts include:

• Credential theft from browsers and password managers.
• Installation of additional payloads such as ransomware.
• Data exfiltration to cloud storage services.
• Use of the infected machine as a relay for further attacks.

Because the malware can masquerade as trusted applications, many organizations only discover the infection after a breach has been active for weeks.

Detection and Mitigation Strategies

Security teams should adopt a layered approach that includes endpoint monitoring, network traffic analysis and threat intelligence sharing.

Endpoint indicators

• Unexpected processes named after popular apps but located in temporary directories.
• Creation of files with random alphanumeric names that contain encrypted data.
• Use of PowerShell commands that query external APIs without a clear business purpose.

Network indicators

• Outbound TLS connections to IP ranges associated with Polygon nodes.
• Frequent DNS queries for domains that resolve to cloud provider IPs shortly after a new blockchain transaction.

Organizations can block known Polygon node IPs at the firewall level as a temporary mitigation while investigating the incident.

Role of Threat Intelligence

Information shared by groups such as the Blackpoint Adversary Pursuit Group helps defenders stay ahead of the evolving tactics. The group’s report on ChainScript includes hash values, command line arguments and sample network traffic captures. Integrating these indicators into a SIEM or EDR platform can trigger alerts the moment a suspicious activity matches the known pattern.

For broader context, the Cybersecurity and Infrastructure Security Agency (CISA) guidance on ransomware outlines best practices that also apply to RAT infections. Additionally, the official Polygon documentation provides insight into the network’s architecture, which can aid analysts in identifying abnormal usage.

Future Outlook

The use of blockchain for C2 rotation is likely to increase as defenders improve traditional domain blocking techniques. Attackers may explore other layer‑2 solutions or even decentralized storage platforms to further obscure their communications. Continuous monitoring of blockchain activity, combined with threat hunting focused on anomalous process behavior, will be essential to detect the next wave of ChainScript variants.

Security professionals should also watch for updates to the MITRE ATT&CK framework, where new techniques related to blockchain‑based command and control are expected to be added. The ATT&CK technique for proxy communication already provides a foundation for mapping these tactics.