ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint APG reports new remote access trojan leveraging social engineering and dynamic C2 rotation

Key Takeaways
- ChainScript is a newly documented remote access trojan distributed via ClickFix-themed lures.
- The malware masquerades as legitimate applications including Spotify, Zoom Workplace, and Microsoft Teams.
- Multiple build names have been observed: ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66.
Related Security News

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations
Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.




