ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Blackpoint's Adversary Pursuit Group has identified a previously unnamed Node.js remote access trojan, now called ChainScript, discovered during a ClickFix campaign investigation. The malware uses a Polygon blockchain smart contract to locate its command-and-control infrastructure dynamically — a technique that makes takedown significantly harder than conventional domain-based C2.

What ClickFix Is

ClickFix is a social engineering technique that has been running since at least late 2025. The victim visits a compromised or attacker-controlled website, where they encounter a fake verification prompt — typically mimicking a Cloudflare CAPTCHA or a software error message — that instructs them to copy and run a command manually.

The prompt says something to the effect of: to proceed, paste this command into your terminal or Run dialog. The victim copies what appears to be a legitimate fix and executes it themselves, bypassing most endpoint security controls in the process because the user, not malware, is making the operating system run the code.

The technique has been observed deploying multiple payloads. ChainScript is the Windows-focused variant identified this week.

How ChainScript Works

ChainScript disguises itself as legitimate software. Installation packages impersonate Spotify, Zoom Workplace and Microsoft Teams, distributed as malicious Windows Installer files.

Once executed, the malware uses what researchers call EtherHiding-style C2 discovery. Rather than having a list of hardcoded command-and-control domains that defenders can identify, block and seize, ChainScript reads a Polygon blockchain smart contract to find where its active C2 infrastructure is at that moment.

The technical mechanism is straightforward. The malware calls the getURL function on the smart contract using the eth_call method — a read-only blockchain query that requires no transaction signing and no gas fee. The smart contract returns the currently active C2 domain as an encoded string. The operator can change that domain at any time simply by updating the contract, without touching any of the deployed malware or compromised sites.

The C2 communication itself runs over WebSocket. The operator can rotate backend infrastructure without rebuilding agents already deployed on victim machines.

Why This Is a Hard Problem for Defenders

The blockchain architecture attacks the normal takedown process at its root.

When defenders identify malicious C2 infrastructure, the typical response is to report domains to registrars for suspension, contact hosting providers for takedown, and add domains to blocklists. That process, while imperfect, works well enough when the attacker has to register and configure a new domain to resume operations.

Polygon changes the economics. The Polygon network is a public blockchain. Once a smart contract is deployed, its data is replicated across all network nodes and cannot be removed through any mechanism available to defenders. No registrar controls it. No hosting provider can suspend it. No CISA or law enforcement notification to an internet company makes it go away. The contract address is the only fixed identifier, and the contract itself cannot be altered by anyone except the deploying wallet.

Between March and May 2026, researchers at Whalebone tracked 59 C2 domains rotated through a single Polygon smart contract at an average rate of one new domain every 22 hours, distributed across hundreds of compromised WordPress sites. The rotation cost the operator almost nothing — blockchain reads are free, domain registration and hosting are cheap, and the entire rotation mechanism required no modification to any compromised site.

The Full Attack Chain

The chain documented across multiple research teams looks like this.

A compromised WordPress site — the entry point is an existing legitimate site with a compromised installation — carries injected loader code in either plaintext or base64+XOR obfuscation. When a visitor arrives, the loader calls the Polygon smart contract to retrieve the current delivery host.

That delivery host serves a fake Cloudflare page that copies a PowerShell command to the clipboard. The user pastes and runs it. ChainScript lands on the machine, pulls its operating configuration from C2, and begins exfiltrating data.

The C2 channel can also push a next-stage payload, though this capability was present but inactive in observed runs.

What ChainScript Can Do

ChainScript's documented command coverage is extensive for a RAT.

Researchers documented browser credential collection, file transfer with resumable upload, process control, shell command execution, remote desktop, keylogging, clipboard access, SOCKS proxy bridging, service installation, and in-memory PE delivery — loading additional executables directly into memory without writing them to disk.

Its endpoint scheduler can rotate between a C2-supplied domain table, four embedded IPv4 fallback addresses, and four .onion addresses reached through a Tor module delivered dynamically. The .onion fallbacks ensure that even if all conventional C2 infrastructure is blocked, the operator retains a communication path through Tor.

How the ClickFix Kit Is Distributed

ErrTraffic, the ClickFix kit used in at least one documented cluster, has been advertised on the Exploit.IN cybercriminal forum since December 2025 by an actor using the name "LenAI." This is a rented kit, not a closed operation — meaning different threat actors can purchase access and run their own ClickFix campaigns using the same infrastructure architecture.

Detection Guidance

Static indicators — individual domains, file hashes — have limited value against this campaign because both rotate rapidly by design.

Behavioural indicators are more durable. The key signals are calls to public blockchain RPC endpoints from web browser sessions where blockchain interaction is not expected, the characteristic ClickFix clipboard-paste prompt pattern in web traffic, and PowerShell execution initiated shortly after web browsing activity.

For defenders with WordPress environments: inspect web server logs for unauthorised modifications to theme files and plugins, where the injected loader is typically placed. ChainScript's loader has been found in both plaintext and base64+XOR forms, so text-based search alone is insufficient — behavioural monitoring of outbound connections from web server processes is the more reliable signal.

The only fixed point an investigator can track is the smart contract address on the Polygon blockchain, which is publicly readable and does not require any engagement with attacker infrastructure to monitor.

Sources: Whalebone Threat Intelligence, CyberArmor, OffSeq/Blackpoint Radar, Melted in Hex, The Hacker News