ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are using ClickFix-style lures to distribute a previously undocumented remote access trojan (RAT) named ChainScript. The malware has appeared under multiple build names including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams to trick users into execution. ChainScript leverages the Polygon blockchain network to rotate its command-and-control (C2) infrastructure, making takedowns more difficult. The campaign was uncovered and reported by Blackpoint's Adversary Pursuit Group (APG). The use of blockchain for C2 rotation represents an advanced evasion technique increasing the resilience of the malware's infrastructure. ClickFix lures typically trick users into executing malicious scripts under the guise of fixing a software issue. This threat is considered high impact due to its novel infrastructure abuse and active deployment.