ClickFix Attacks Deploy ChainScript RAT: Threat Actors Weaponize Polygon Blockchain Smart Contracts for Resilient WebSocket C2
Author: DigitalSpying Security Desk
Date: September 21, 2026
Category: Malware Analysis / Web3 & Blockchain Threats / Social Engineering
Executive Summary
A sophisticated new malware campaign is bridging modern social engineering techniques with decentralized blockchain infrastructure to establish nearly indestructible command-and-control (C2) pipelines. As exposed by threat researchers at Blackpoint Cyber APG and reported by The Hacker News and Hackread, adversaries are leveraging deceptive ClickFix browser overlays to deliver a previously undocumented remote access trojan (RAT) dubbed ChainScript.
ChainScript—circulating under internal build identifiers such as ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66—masquerades as legitimate enterprise collaboration and media applications, including Spotify, Zoom Workplace, and Microsoft Teams. The primary infection vector bypasses browser security sandboxes by manipulating users into executing an obfuscated PowerShell snippet directly in the Windows Run prompt (Win + R). Once established on the endpoint, ChainScript employs an EtherHiding-style C2 discovery mechanism: rather than relying on vulnerable DNS domains or hardcoded IP addresses, the malware communicates with smart contracts deployed on the Polygon blockchain to dynamically resolve its active WebSocket C2 server infrastructure. Armed with this resilient C2 channel, the Node.js-based Trojan delivers extensive administrative capabilities, including interactive PowerShell sessions, remote file manipulation, desktop screen recording, automated cryptocurrency wallet theft, and dynamic JavaScript execution.
Deep-Dive Technical Analysis
1. Delivery Architecture: The ClickFix Social Engineering Vector
The ChainScript infection lifecycle begins with deceptive ClickFix landing pages distributed via search engine optimization (SEO) poisoning, malvertising, and compromised legitimate websites:
* The Application Lure: Victims searching for popular productivity and communication utilities (Microsoft Teams, Zoom Workplace, Spotify Desktop) land on convincingly rendered software distribution pages.
* The Synthetic Error Modal: When the user clicks "Download" or "Join Meeting," the browser displays a deceptive overlay styled after Google Chrome, Microsoft Edge, or Windows Defender. The prompt alerts the user that a required audio codec, certificate update, or verification token failed to load.
* Circumventing Browser Sandboxes: Rather than downloading an executable file (which modern browsers subject to reputation scans and SmartScreen analysis), the dialog displays a "Fix Problem" button. Clicking this button silently copies a heavily obfuscated PowerShell command into the user's system clipboard.
* User-Assisted Shell Invocation: The modal instructs the victim: "Press Win + R, press Ctrl + V, and hit Enter to resolve the installation issue." When the victim complies, the command executes directly within the native Windows operating system shell (powershell.exe), escaping the browser sandbox entirely.
+----------------------------------------------------------------------------------------------------+
| CHAINSCRIPT RAT INFECTION LIFECYCLE |
|---|
[Target User visits Spoofed Software Portal (Teams / Zoom / Spotify)]
|
| 1. ClickFix modal appears: "Verification Failed / Install Helper"
| 2. User clicks button -> Obfuscated PowerShell stager copied to clipboard
v
[Victim executes snippet in Windows Run Dialog (Win + R -> Ctrl + V -> Enter)]
|
| 3. PowerShell executes encoded stager -> Downloads ChainScript Bundle
v
[ChainScript Node.js / Electron Runtime Deployed]
|
| 4. Registers persistence via Scheduled Tasks & Run Registry keys
v
[Polygon Blockchain C2 Discovery (EtherHiding)]
|
| 5. Transmits JSON-RPC eth_call to Public Polygon Gateway Node
| 6. Interrogates deployed Smart Contract -> Decodes encrypted C2 parameters
v
[Encrypted WebSocket C2 Communication Channel Established]
|
| 7. Establishes bi-directional real-time WebSocket connection to Attacker C2
v
[Full System Compromise & Post-Exploitation]
|
+---> Interactive CMD / PowerShell execution
+---> Harvests browser credentials & session tokens
+---> Enumerates desktop & extension crypto wallets (MetaMask, Phantom, Ledger)
+---> Takes real-time desktop screenshots & logs keystrokes
+---> Executes arbitrary in-memory JavaScript payloads
2. The Blockchain C2 Resolver: EtherHiding via Polygon Smart Contracts
The defining architectural advancement of ChainScript is its decentralized command-and-control discovery pipeline:
* The Problem with Traditional C2: Hardcoded IP addresses and domain names are easily detected, sinkholed, or dismantled through domain registrar takedowns and threat intelligence blocklists.
* The EtherHiding Solution: ChainScript integrates Web3 client logic that targets the Polygon blockchain (a high-speed, low-cost Ethereum Layer 2 network).
* Querying Public JSON-RPC Nodes: The malware does not run a full blockchain node; instead, it dispatches standard HTTPS eth_call JSON-RPC requests to public, highly reputable Polygon infrastructure providers (e.g., polygon-rpc.com, Alchemy, or Infura).
* On-Chain Payload Reconstruction: The query calls a view function on a preconfigured smart contract address. The contract's internal state variable contains a hex-encoded, AES-encrypted string. ChainScript pulls this data, decrypts it using an embedded key, and extracts the current operational WebSocket C2 endpoint (e.g., wss://active-node[.]xyz:8443).
* Unstoppable Operational Agility: If incident responders or hosting providers seize an active C2 server, the threat actors simply broadcast a new signed transaction to the Polygon network updating the smart contract variable. The entire botnet seamlessly re-routes to the new C2 server on its next check-in without requiring any client-side code updates.
3. Payload Capabilities: The Node.js Modular Engine
ChainScript is engineered as a Node.js-based remote access agent packaged within an obfuscated standalone binary:
* Interactive Terminal Control: The C2 operator can spawn full interactive Windows Command Prompt (cmd.exe) and PowerShell sessions, granting full shell access to the host.
* Cryptocurrency & Credential Targeting: ChainScript features dedicated scanning modules that search local app data directories (%APPDATA%, %LOCALAPPDATA%) for desktop wallet clients (Exodus, Atomic, Electrum) and scans Chromium/Gecko profiles for browser wallet extensions (MetaMask, Coinbase Wallet, Phantom, Ronin).
* Dynamic JavaScript Evaluation: Operators can push raw JavaScript snippets over the WebSocket channel. The agent executes them directly within its Node.js environment, allowing the operator to dynamically extend functionality, download secondary payloads, or pivot into internal corporate networks.
Industry Impact & Evasion Implications
The deployment of ChainScript via ClickFix social engineering highlights the evolving convergence between advanced evasion and criminal resilience:
1. The Weaponization of Legitimate Web3 Infrastructure: By utilizing public Polygon RPC endpoints, the malware's initial C2 query blends seamlessly into benign network traffic. Firewalls that allow general web traffic cannot block public Web3 RPC providers without breaking legitimate decentralized applications.
2. Defeating Endpoint DNS Protection: DNS filtering solutions (such as Cisco Umbrella, Quad9, or Cloudflare Gateway) are completely bypassed because the domain resolution happens inside the smart contract data layer rather than standard DNS lookup routines.
3. The Ongoing Danger of User-Assisted Execution: Security awareness training has taught users not to run downloaded .exe files, but many users do not recognize that pasting commands into the Windows Run console executes arbitrary native code with full user permissions.
Recommendations & Mitigation Strategies
Enterprise security operations and system administrators must implement layered controls spanning identity, group policy, and network perimeter filtering.
1. Group Policy Hardening Against ClickFix Attacks
* Disable the Windows Run Prompt: For standard enterprise workstations and non-administrative user accounts, disable the Windows Run dialog via Group Policy (GPO):
* Path: User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu.
* Restrict User-Space PowerShell Execution: Implement PowerShell Constrained Language Mode and enforce AppLocker or Windows Defender Application Control (WDAC) to prevent non-administrative users from executing unapproved PowerShell commands or running scripts from temporary user directories (%APPDATA%, %TEMP%).
2. Network Perimeter & Web3 Egress Filtering
* Filter Public Blockchain RPC Endpoints: If your enterprise does not conduct business operations requiring Web3 or cryptocurrency functionality, block outbound HTTPS traffic to public blockchain JSON-RPC gateways (such as *.polygon-rpc.com, rpc.ankr.com, *.infura.io, and public Ethereum/BNB endpoints).
* Monitor WebSocket Egress Traffic: Implement deep packet inspection (DPI) to monitor long-lived, encrypted WebSocket connections (wss://) established to untrusted dynamic domains or non-standard external ports.
3. Endpoint Threat Hunting & Behavioral Detections
* Flag Anomalous PowerShell Execution Chains: Configure Endpoint Detection and Response (EDR) agents to generate immediate high-severity alerts when explorer.exe spawns powershell.exe with base64-encoded command flags (-enc, -EncodedCommand) or command strings initiating web downloads (Invoke-WebRequest, DownloadString).
* Audit Scheduled Tasks & Run Keys: Continuously monitor HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Windows Task Scheduler (schtasks.exe) for newly registered tasks executing Node.js binaries or scripts named ComponentTask33, UpdateDigital, or HostShared.