520/69 Tuesday, September 22, 2026
Researchers from Blackpoint have discovered a new Remote Access Trojan (RAT) named ChainScript, developed in Node.js. The malware is being distributed through a ClickFix campaign that tricks users into copying and running malicious commands. A notable feature of this malware is its use of blockchain technology to hide its command-and-control server infrastructure, allowing threat actors to continuously change server addresses without modifying the malware already installed on victims’ machines. This concealment technique makes traditional defenses based on blocking IP addresses or domains more difficult.
The attack begins by tricking victims into running a command that launches msiexec.exe to download an installer disguised as legitimate software, such as Spotify, Zoom Workplace, or Microsoft Teams. The installer contains a Node.js runtime and a main script named app\src\index.js, allowing the malware to operate without requiring administrator privileges on the victim’s device. Once executed, the malware uses a technique known as EtherHiding to locate its command server. It includes a function called readPanelUrlFromContract to validate the server address and send an eth_call command through JSON-RPC to a smart contract on the Polygon network. When the response returns a server address beginning with ws:// or wss://, the malware connects to it and opens a channel that allows the attacker to gain full control of the machine, including file access, screenshot capture, and scanning for cryptocurrency wallets on the system.
The use of blockchain technology to conceal attack infrastructure is becoming increasingly common. Administrators and cybersecurity personnel should therefore shift monitoring approaches from relying solely on domain or IP blocklists to detecting abnormal process execution chains within systems. An initial detection approach is to monitor behavior where msiexec launches wscript, which then continues to node.exe to run app\src\index.js. In addition, if node.exe is observed sending outbound requests to blockchain networks through RPC while also opening a WebSocket connection, the activity should be treated as high risk. Administrators should isolate the affected machine from the network and immediately conduct system investigation to reduce potential risk and impact.