ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Cosa significa
Threat actors use ClickFix lures to deploy ChainScript RAT, a previously undocumented remote access trojan. The malware disguises itself as legitimate software and uses a Polygon smart contract to rotate C2 infrastructure. The attack chain starts with a malicious Windows installer that executes via msiexec.exe, deploying the RAT through hidden PowerShell and VBScript stages. The malware provides extensive remote access and can self-update and remove persistence. The threat actors also compromised HBO Max's Reddit account to push malicious ads, leading to infections on Windows and macOS devices with various stealers.
Perché conta
For Italian PMIs, this represents a significant risk as ChainScript can grant attackers full control over systems, leading to data theft, financial loss, and operational disruption. The use of decentralized infrastructure and social engineering via trusted accounts like Reddit makes detection and mitigation more challenging.
Azioni consigliate
- Patch systems to prevent exploitation of known vulnerabilities in ClickFix lures.
- Implement strict application whitelisting to block unauthorized MSI installers.
- Deploy endpoint detection and response (EDR) tools to monitor for PowerShell and VBScript execution.
- Enable multi-factor authentication (MFA) for all user accounts to prevent unauthorized access.
- Regularly audit scheduled tasks and registry entries for suspicious entries.
- Use network monitoring tools to detect WebSocket traffic to unknown C2 servers.
- Educate users on the risks of clicking on suspicious links and downloading unknown software.
Benefici operativi potenziali
- Reduces the risk of malware deployment through ClickFix lures.
- Enhances detection and response capabilities against ChainScript RAT.
- Improves overall system resilience against advanced persistent threats.
- Strengthens user authentication and access control mechanisms.
Traduzione in elaborazione
Il contenuto ufficiale è disponibile nella lingua originale. La versione italiana verrà pubblicata al termine dei controlli automatici.
Testo acquisito dalla fonte
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)
- Fonte
- The Hacker News
- Entità pubblicatrice
- The Hacker News
- Tipo entità
- editorial osint
- Area
- Global
- Lingua originale
- en · traduzione in preparazione
- Pubblicazione
- 21/09/2026 10:39
- MITRE ATT&CK
- T1190, T1078, T1486