A newly identified remote access trojan (RAT) known as ChainScript has been tied to ClickFix-themed social engineering campaigns. Analysts have observed the malware being distributed using deceptively labeled installers presented as popular applications including Spotify, Zoom Workplace, and Microsoft Teams under build names like ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. The deployment trail typically begins with a ClickFix lure that tricks victims into launching a malicious MSI installer. Once in place, the malware uses embedded Node.js runtime, disguised scripts, and obfuscated paths to blend in.
How ChainScript Operates
ChainScript’s architecture allows near-total access to compromised Windows machines. Its feature set includes executing user commands via CMD and PowerShell, managing files, capturing screenshots, deploying further payloads, running arbitrary JavaScript, and enumerating cryptocurrency wallets from both browser extensions and native desktop applications. Persistence is achieved via scheduled tasks with a fallback to a Registry Run key. Upon launch, a Windows agent reaches out to its command-and-control (C2) infrastructure via WebSockets. It can pull down additional instructions, self-update, or strip itself of persistence.
Polygon Contracts, C2 Rotation, and Evasion Techniques
One of ChainScript’s most novel techniques is using a smart contract on the Polygon blockchain as part of its C2 discovery mechanism. By decoupling the implant from the actual network infrastructure, the malware’s operators can shift C2 servers dynamically—rendering traditional detection methods and takedown efforts far less effective. This mirrors recent malware trends employing decentralized backend discovery systems.
ClickFix Campaigns: Mac, Windows and Web Lures
The malware arrives via ClickFix-style lures set up through malicious ads. One campaign hijacked a verified corporate social media account to push dozens of adverts over a short span. Windows systems in these campaigns receive RAT payloads like ChainScript, along with cryptocurrency clippers such as AnimateClipper and ZigClipper. macOS systems, meanwhile, are hit with information stealers like MacSync, Atomic Stealer, and counterfeit wallet tools designed to steal recovery phrases. Over a two-day stretch in mid-September 2026, one such Reddit-based campaign ran more than a hundred malicious ads.
Other ClickFix efforts involve misleading search results that lure users to fake download portals or Google Sites masquerading as legitimate tools. On macOS, this has included a six-part attack chain: a fake codex installer leads to a shell script loader, which then runs a disguised Mach-O payload. Meanwhile, those not on macOS are often served harmless decoy pages to reduce suspicion from security tools.
Security researchers interpret these campaigns as part of an established assault vector exploiting trusted services, cloned corporate assets, polished ad creatives, browser fingerprinting, and cloaking tactics to avoid detection by automated systems and Safe Browsing mechanisms. Analysts say MacSync infections are concentrated in the U.S., U.K., Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands. Enterprise sectors, developers, and Web3 users have been favorite targets.
The ongoing campaigns reflect a wider evolution in malware culture: operators are moving toward infrastructure that’s resilient, programmable, and built for stealth. By using blockchain-based discovery and false branding, they’re raising the bar for defenders. Tools that rely on static indicators, brand logos, or IP-based blacklisting are increasingly ineffective against this breed of threat.
Time will tell how quickly defenders can adapt detection tools and law enforcement strategies to keep up with malware built for decentralization and tactics rooted in Web3. Vigilance, behavioral monitoring, and intelligence sharing will be key to staying ahead.
