ChainScript RAT is a newly documented Node.js remote-access trojan that uses a Polygon smart contract to discover its active command-and-control server after infection. Blackpoint Cyber traced the malware through ClickFix-style fake installers impersonating familiar applications including Spotify, Zoom Workplace and Microsoft Teams, and published host, file, domain, IP and blockchain indicators defenders can use for investigation.
Current answer: ChainScript does not show that Polygon itself was breached. The analyzed malware abuses a normal Polygon smart contract as an indirection layer that returns the active WebSocket command server. Blackpoint observed the contract return different backend endpoints during its analysis, so defenders should not assume that blocking one historical C2 domain is enough to rule out or contain the RAT.
What is ChainScript RAT?
Blackpoint Cyber’s Adversary Pursuit Group identified ChainScript as a Node.js RAT with remote-control capabilities including command execution, file manipulation, screenshots, payload deployment, cryptocurrency-wallet discovery, remote JavaScript execution, updates and cleanup.
The malware is designed to give an operator broad control over an infected Windows endpoint after the initial delivery stage succeeds.
How is ChainScript delivered?
Blackpoint observed ChainScript in ClickFix-style activity using fake software installers and deceptive application-download flows. The campaign impersonated legitimate applications rather than compromising the real vendors’ software distribution infrastructure.
Observed lure brands included Spotify, Zoom Workplace and Microsoft Teams. That means a user can encounter a page or installer made to look associated with one of those products even though the reviewed evidence does not show that Spotify, Zoom or Microsoft were themselves breached.
Which ChainScript builds were observed?
Blackpoint documented several named builds in the analyzed campaign, including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66. Those names help defenders distinguish observed samples, but they should not be treated as a complete list of every possible future ChainScript build.
How the Polygon smart-contract C2 works
The most unusual part of ChainScript is how it discovers its backend infrastructure. Instead of depending only on a permanent C2 address embedded in the malware, the analyzed build queries a Polygon smart contract and obtains the WebSocket endpoint it should contact.
Blackpoint documented Polygon chain ID 137 and contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 in the analyzed ComponentTask33 build. The contract acts as a resolver. The command server remains conventional attacker-controlled infrastructure; the blockchain is used to tell the infected endpoint where that backend currently is.
Did Blackpoint actually observe the C2 change?
Yes. During Blackpoint’s analysis, the resolver first returned shift-api-control[.]com:3847. After the session reset and the malware resolved the contract again, it returned bedotiq[.]net:3854.
That observed change is important because it demonstrates why a static blocklist alone is incomplete. A historical domain can become stale while the same infected endpoint continues using the same resolver mechanism to discover a replacement server.
Is Polygon compromised?
No Polygon compromise is established by the reviewed research. ChainScript is using a public blockchain service as an infrastructure indirection mechanism. The malware does not need to exploit Polygon itself to store or retrieve a value from a smart contract.
This distinction also matters for incident response: a defender should focus on the infected Windows host, malware execution and persistence, resolver behavior and downstream C2 connections rather than treating the event as a blockchain-network breach.
Which ChainScript indicators were published?
Blackpoint published multiple network and host indicators tied to the analyzed activity. Network indicators included domains such as api-configuard[.]com, kerosand[.]net, shift-api-control[.]com, moweros[.]net, bedotiq[.]net and giperon[.]net, together with IP infrastructure including 176.65.144[.]127 and 176.65.144[.]40.
These values are useful for threat hunting, but they should be interpreted in context. Some were historical or observed during analysis, and the architecture itself allows backend rotation. TPS did not independently establish that every listed endpoint remains active at the time of publication.
What should defenders hunt beyond domains and IPs?
Review download history, browser activity and endpoint telemetry around fake or unexpected Spotify, Zoom, Teams or similar installer flows.
Compare endpoint artifacts against the published Blackpoint IOC set and investigate matching files, scripts and persistence evidence.
Review unusual Node.js, command-shell, PowerShell and script activity associated with the suspected infection window without assuming every such process is malicious.
Correlate historical domains and IPs with network telemetry, but do not treat one absent domain hit as proof the host is clean.
Use the published contract and associated behavior as supporting intelligence alongside host and network evidence rather than as a standalone compromise verdict.
Why one C2 block is not enough
The defender problem is not that the published network indicators are useless. They can be highly valuable for retrospective hunting and containment. The limitation is that ChainScript’s resolver mechanism can allow the operator to change backend infrastructure without rebuilding every deployed agent.
A stronger investigation therefore combines relatively stable malware and execution evidence with the published resolver identity and the more changeable network indicators.
What can ChainScript do after infection?
Blackpoint documented functionality for remote command execution, screenshot capture, file operations, payload delivery, cryptocurrency-wallet enumeration, JavaScript execution, software updates and cleanup. Those capabilities make a confirmed infection an endpoint-compromise event rather than merely an unwanted application installation.
Organizations with credible matches should follow their established incident-response process, isolate affected systems when appropriate, preserve evidence and review any credentials or sensitive data that may have been exposed through the compromised host.
Are the Spotify, Zoom and Teams brands themselves compromised?
The reviewed evidence supports brand impersonation, not compromise of the legitimate vendors. ChainScript operators used installers or delivery material designed to resemble familiar applications. TPS found no basis in the completed research to state that the official Spotify, Zoom or Microsoft Teams software distribution systems were breached as part of this campaign.
Who is behind ChainScript?
Attribution remains unresolved in the evidence reviewed by TPS. Blackpoint’s analysis establishes the malware architecture and associated infrastructure but does not provide a sufficiently supported named-actor attribution for publication as fact.
What would materially change the current assessment?
The most important future developments would include new ChainScript builds, additional lure brands, smart-contract or resolver changes, newly observed C2 infrastructure, confirmed victim telemetry, new endpoint detections, attribution evidence or infrastructure disruption and takedown activity.
Those developments belong on this same canonical while the reader’s task remains identifying ChainScript and verifying exposure.
Verification note
TPS reviewed Blackpoint Cyber’s primary ChainScript analysis and current independent security coverage. Blackpoint directly documented the Node.js RAT, observed application impersonation, Polygon resolver contract, changing C2 results and defensive IOCs. Victim count, attribution and the live status of every published endpoint remain unresolved.
Bottom line: ChainScript is a confirmed Node.js RAT with a documented Polygon-based C2 discovery mechanism. The smart contract is an infrastructure resolver, not evidence that Polygon was hacked. Defenders should use the published IOCs, but combine them with host, execution, persistence and resolver evidence because backend domains can rotate.