ChainScript Uses Smart Contracts to Keep Attack Infrastructure Moving
Security researchers have uncovered ChainScript, a previously undocumented Node.js remote-access trojan that uses the Polygon blockchain to dynamically locate its command-and-control (C2) infrastructure.
Discovered by Blackpoint Cyber’s Adversary Pursuit Group while investigating ClickFix attacks, the malware provides extensive remote-control capabilities while making traditional domain and IP-based blocking less effective.
Fake Software Installers Launch the Infection
The attack begins with a ClickFix-style lure that convinces victims to execute a command launchingmsiexec.exe, which downloads a malicious Windows Installer disguised as legitimate software.
Researchers observed ChainScript impersonating Spotify, Microsoft Teams and Zoom Workplace, with builds carrying names including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66.
The installer includes its own Node.js runtime and JavaScript agent.
Hidden PowerShell and VBScript stages launch the malware and establish persistence inside the user's profile, allowing the infection to operate without requiring administrator privileges.
Polygon Contract Becomes a C2 Resolver
ChainScript's defining feature is its EtherHiding-style infrastructure design.
Rather than depending on a fixed C2 address embedded permanently in the malware, ChainScript queries a smart contract on the Polygon blockchain. The contract returns the currentws://orwss://WebSocket endpoint that the infected machine should contact.
Operators Can Rotate Servers Without Rebuilding Malware
Blackpoint directly observed the technique during analysis. The contract initially directed ChainScript toward one backend; after the connection was reset and the malware queried the contract again, it received a different server address.
This allows operators to replace C2 infrastructure without modifying or redistributing malware already installed on victim machines.
Independent analysis also found that one resolver contract was deployed only 23 seconds before its corresponding malicious installer was created, strongly suggesting that contract deployment may be automated as part of ChainScript's build process.
RAT Provides Extensive Remote Control
Once connected, ChainScript gives attackers a broad set of capabilities, including interactive CMD and PowerShell sessions, file transfers, screenshots, additional payload deployment and arbitrary JavaScript execution.
The malware can also identify installed cryptocurrency wallets and browser wallet extensions, update itself and remove components when instructed.
Researchers did not identify dedicated functionality for directly extracting wallet seed phrases or private keys in the analyzed version. However, its remote shell and file-access capabilities could still provide operators with significant control over a compromised endpoint.
Blockchain C2 Challenges Traditional Detection
ChainScript highlights a growing defensive problem: C2 indicators can become disposable when malware separates infrastructure discovery from the malware itself.
Blocking a known malicious domain may therefore provide only temporary protection if attackers can simply update the smart contract to point infected systems toward replacement infrastructure.
Security teams should focus on behavioral indicators alongside conventional IOCs. Suspicious chains involvingmsiexec,wscript, VBScript andnode.exedeserve scrutiny, particularly when Node.js unexpectedly contacts blockchain RPC infrastructure before establishing a WebSocket connection.
ChainScript demonstrates how public blockchain infrastructure can be repurposed as a resilient control layer—not by hosting the malware's command server, but by giving attackers a durable mechanism for continuously redirecting compromised machines toward it.