hacker-news · Crawled Sep 21, 2026

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

1 IoCs 1 Malware
Read original article ↗

AI Summary

Threat actors are using ClickFix-style social engineering lures to distribute a new remote access trojan (RAT) named ChainScript, which provides extensive remote control capabilities including command execution, file operations, screenshot capture, and cryptocurrency wallet theft. The malware uses a malicious Windows installer disguised as legitimate software (e.g., Spotify) to deploy a Node.js-based JavaScript agent via PowerShell and VBScript stages, establishing persistence through scheduled tasks and Registry Run keys. ChainScript employs a novel C2 discovery mechanism leveraging a Polygon blockchain smart contract to dynamically rotate WebSocket-based command-and-control infrastructure, enhancing resilience against takedowns. This campaign overlaps with another abuse of HBO Max's Reddit account, distributing macOS and Windows malware such as MacSync, Atomic Stealer, and Amatera Stealer under the PasteSwitch operation.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware AMOS →

Indicators of Compromise 1 extracted

Type Value Detail
Filename ComponentTask33-4d14e6ac.msi Details →

MITRE ATT&CK TTPs 40 techniques

T1003 OS Credential Dumping · Credential Access T1013 T1013 T1016 System Network Configuration Discovery · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1056.001 Keylogging · Collection T1056.002 GUI Input Capture · Collection T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1069.001 Local Groups · Discovery T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078 Valid Accounts · Defense Evasion T1078.001 Default Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1086 T1086 T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1136.001 Local Account · Persistence T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1218.011 Rundll32 · Defense Evasion T1485 Data Destruction · Impact T1497 Virtualization/Sandbox Evasion · Defense Evasion T1499.004 Application or System Exploitation · Impact T1543.001 Launch Agent · Persistence T1547.001 Registry Run Keys / Startup Folder · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1557 Adversary-in-the-Middle · Credential Access T1566 Phishing · Initial Access T1647 Plist File Modification · Defense Evasion