ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
What it means
Threat actors use ClickFix lures to deploy ChainScript RAT, a previously undocumented remote access trojan. The malware disguises itself as legitimate software and uses a Polygon smart contract to rotate C2 infrastructure. The attack chain starts with a malicious Windows installer that executes via msiexec.exe, deploying the RAT through hidden PowerShell and VBScript stages. The malware provides extensive remote access and can self-update and remove persistence. The threat actors also compromised HBO Max's Reddit account to push malicious ads, leading to infections on Windows and macOS devices with various stealers.
Why it matters
For Italian PMIs, this represents a significant risk as ChainScript can grant attackers full control over systems, leading to data theft, financial loss, and operational disruption. The use of decentralized infrastructure and social engineering via trusted accounts like Reddit makes detection and mitigation more challenging.
Recommended actions
- Patch systems to prevent exploitation of known vulnerabilities in ClickFix lures.
- Implement strict application whitelisting to block unauthorized MSI installers.
- Deploy endpoint detection and response (EDR) tools to monitor for PowerShell and VBScript execution.
- Enable multi-factor authentication (MFA) for all user accounts to prevent unauthorized access.
- Regularly audit scheduled tasks and registry entries for suspicious entries.
- Use network monitoring tools to detect WebSocket traffic to unknown C2 servers.
- Educate users on the risks of clicking on suspicious links and downloading unknown software.
Potential operational benefits
- Reduces the risk of malware deployment through ClickFix lures.
- Enhances detection and response capabilities against ChainScript RAT.
- Improves overall system resilience against advanced persistent threats.
- Strengthens user authentication and access control mechanisms.
Translation in progress
The official content is available in the original language. The Italian version will be published once automated checks are complete.
Text acquired from the source
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)
- Source
- The Hacker News
- Publishing entity
- The Hacker News
- Entity type
- editorial osint
- Area
- Global
- Original language
- en · translation in preparation
- Publication
- 21/09/2026 10:39
- MITRE ATT&CK
- T1190, T1078, T1486