ClickFix lures deliver ChainScript RAT using Polygon C2

Security researchers at Blackpoint's Adversary Pursuit Group (APG) have documented a previously unseen remote access trojan (RAT), a program that gives an attacker ongoing control over someone else's computer, which the researchers call ChainScript and which is delivered through ClickFix lures. ClickFix is a trick in which a web page claims that something is broken and invites the visitor to copy a small "fix", often a command to paste into a terminal, which in reality installs malicious code. What stands out about this family is how it locates the servers that control it: rather than using a fixed internet address, ChainScript relies on a smart contract on the Polygon blockchain, a small program that runs on that network, acting as an external resolver for its command-and-control (C2) infrastructure. C2 is the term for the servers an attacker uses to send instructions to infected machines and to collect data back.

According to Blackpoint, whose findings were published by researchers Sam Decker, Andi Ursry and Nevan Beal, ChainScript has appeared under several build names, including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace and Microsoft Teams software. The attack chain begins with a ClickFix lure that leads to the download and execution of a malicious Windows installer through msiexec.exe, the standard Windows component that installs .msi packages. The installer described in the analysis, ComponentTask33-4d14e6ac.msi, is disguised as Spotify. It deploys the Node.js runtime, a program that lets JavaScript code run outside a web browser, and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages. PowerShell is the built-in Windows scripting engine, and VBScript is another scripting language Windows understands. The PowerShell script drops the runtime, the agent source code, its configuration and other auxiliary binaries into several folders with Microsoft-looking names inside the %LOCALAPPDATA% folder, a per-user storage area on Windows. The VBScript serves as the main launcher for the trojan.

Blackpoint says the running agent establishes persistence at user level, meaning it arranges to start again after a restart, by creating a scheduled task, with a Registry Run key as a fallback method. Once it is running, ChainScript connects to its C2 server over WebSockets, a connection that stays open so both sides can exchange messages at any moment, and retrieves additional tasking, which hands the operator direct control of the compromised system. The supported commands include interactive CMD and PowerShell access, file operations, screenshot capture, payload deployment, enumeration of cryptocurrency wallets across both desktop applications and browser extensions, and remote execution of JavaScript. The same commands also allow the trojan to update itself and to remove its own persistence.

In its assessment, Blackpoint frames these findings as an illustration of how threat actors are increasingly adopting flexible, decentralised infrastructure to resist takedown efforts and keep operations running without interruption. The company describes the technique as part of an emerging pattern in which malware uses development frameworks together with blockchain-based C2 discovery to enable infrastructure rotation and to complicate traditional detection based on known indicators. Because the discovery of the backend is separated from the malware itself and the Polygon contract works as an external resolver, Blackpoint explains, an operator can redirect already infected hosts to new infrastructure while keeping the same implant and the same reconnect routine. The technique is described as EtherHiding-style, echoing other malware families seen in recent months.

The disclosure arrives alongside a separate ClickFix case in which attackers took over the official Reddit account of HBO Max, u/hbomax, and abused it to push malicious ads that launched ClickFix attacks against Windows and macOS devices in order to install information-stealing malware. Hudson Rock and ADAMnetworks, which tracked the activity under the name PasteSwitch, say it is not known how the account was breached, nor how many people clicked on the fake ads and how many were compromised as a result. On macOS, PasteSwitch delivered MacSync, Atomic macOS Stealer (AMOS) and fake cryptocurrency wallet applications built to steal recovery phrases, the words that restore access to a crypto wallet. On Windows, it distributed Amatera Stealer and cryptocurrency clippers such as AnimateClipper and ZigClipper. A clipper is a program that watches what a victim copies and silently swaps a copied wallet address for one controlled by the attacker. The verified Reddit account served 108 malicious ads over a 48-hour period in mid-September 2026.

Data shared by Seqrite Labs shows MacSync infections concentrated in the United States, followed by the United Kingdom, Germany, Japan, Canada, France, Singapore, Australia, India and the Netherlands. Researcher Chandra Kant Bauri said the campaigns primarily target regions with widespread macOS use in enterprises, the technology and software development sectors, and active cryptocurrency or Web3 communities. Hudson Rock noted that the attackers used highly polished assets to build trust, and that by hijacking a verified corporate account they bypassed the initial scepticism many users apply to internet advertising.

A third ClickFix campaign reported by Cato Networks uses a fake Codex download that appears in search results and leads users to bogus Google Sites pages, where macOS users are tricked into pasting a malicious command into Terminal, resulting in the execution of Atomic Stealer. Visitors on non-Mac devices are shown a harmless decoy page instead, so the trap stays hidden from anyone whose device does not match the target. Cato Networks described the copied Terminal command as the first stage: it retrieves a shell-script loader that contains an embedded blob, which is decoded and executed with eval to produce a second-stage shell script, and that second stage records the execution and retrieves the final, third-stage Mach-O payload, the executable format used on macOS. Cato places this activity in a broader pattern of attacks that abuse trusted services and shared chats with large language models to serve fake installation instructions while avoiding browser warnings, URL inspection and Safe Browsing heuristics.

In a report published last month, Microsoft said it observed a macOS ClickFix campaign spreading MacSync and Atomic Stealer through a cluster of no fewer than 250 look-alike domains. Microsoft said the campaign evolved from broadly serving ClickFix lures to using a server-side browser-fingerprinting gate, a check that inspects the visitor's browser before deciding what to show, so the lure is displayed mainly to visitors whose environment appears consistent with a genuin