Cybersecurity experts are raising alarms about a new threat actor tactic involving the deployment of a remote access trojan (RAT) named ChainScript. This sophisticated malware uses ClickFix-like lures and a Polygon smart contract to obscure its command-and-control (C2) infrastructure.
ChainScript’s Stealthy Deployment
Recently documented by researchers from Blackpoint Adversary Pursuit Group, ChainScript disguises itself as popular software applications such as Spotify, Zoom Workplace, and Microsoft Teams. After installation via a malicious Windows installer, it provides extensive remote capabilities to attackers. Key functionalities include executing CMD and PowerShell commands, managing files, capturing screenshots, deploying payloads, and even targeting cryptocurrency wallets.
The malware’s initial invasion vector is a ClickFix lure, tricking users into downloading a malicious installer. This installer activates the Node.js runtime, launching ChainScript through concealed PowerShell and VBScript stages. These scripts distribute various components across Microsoft-like directories in the “%LOCALAPPDATA%” folder, ensuring the malware’s persistence through scheduled tasks and registry keys.
Polygon’s Role in Evasion
ChainScript’s use of a Polygon smart contract for C2 discovery reflects an advanced tactic to evade detection. By separating backend discovery from the malware itself, operators can easily rotate infrastructure without altering the malware’s functionality. This method complicates traditional detection techniques, allowing the malware to maintain its operations despite takedown efforts.
Blackpoint researchers note this trend as part of a broader shift towards decentralized infrastructures in the malware landscape. The ability to redirect infected hosts to new servers while keeping the same workflow poses significant challenges to defenders in the cybersecurity field.
The Broader Implications of ClickFix Campaigns
The ChainScript threat is part of a larger web of ClickFix campaigns impacting both Windows and macOS users. Notably, a breach of HBO Max’s Reddit account led to the spread of malicious ads, further distributing malware like MacSync and Atomic macOS Stealer. These campaigns leverage highly credible assets to bypass user skepticism and deliver harmful payloads.
Seqrite Labs data highlights that MacSync infections are most prevalent in regions with significant macOS enterprise use, such as the U.S., U.K., and Germany. The continuous evolution of these campaigns, including advanced cloaking techniques, showcases the increasing sophistication of threat actors.
Cato Networks identified the use of fake Codex download experiences as a tactic to deceive macOS users into executing malicious commands. This strategy underscores the broader pattern of using trusted platforms and services for malware distribution, making detection and prevention more challenging.
In conclusion, the emergence of ChainScript and related ClickFix campaigns signals a notable escalation in the complexity of cyber threats. As threat actors continue to innovate, cybersecurity measures must adapt to these evolving tactics to protect users and data effectively.
