ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Blackpoint's Adversary Pursuit Group has identified a new campaign distributing ChainScript, a remote access trojan observed under multiple build identifiers. The threat actors utilize ClickFix-themed lures to trick victims into executing the malware. ChainScript has been distributed under build names such as ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams applications. The campaign leverages social engineering techniques consistent with previously observed ClickFix distribution methods. A notable aspect of this operation is the use of Polygon infrastructure to dynamically rotate command-and-control (C2) endpoints, a technique intended to maintain persistence and hinder defensive blocking efforts. Blackpoint has linked the campaign to financially motivated threat activity, though specific threat actor attribution remains under investigation. The malware's capabilities and full code analysis are ongoing.