MalwarePublished 18 Sep 2026Updated 18 Oct 2026

ChainScript: Tracing a Node.js RAT Through the Blockchain

Source AlienVault OTX General

Description

ChainScript is a Node.js remote access trojan (RAT) identified by Blackpoint's Adversary Pursuit Group. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams via malicious Windows Installer packages. The malware uses a Polygon blockchain smart contract to dynamically discover its command and control (C2) infrastructure, allowing operators to rotate backend services without rebuilding agents. ChainScript offers extensive remote access features including shell access, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-updating, and cleanup. Multiple builds with different names share the same core architecture.

Impact

The malware provides attackers with comprehensive remote access to infected systems, enabling them to execute arbitrary commands, manipulate files, capture screenshots, deploy additional payloads, discover and potentially steal cryptocurrency wallets, and maintain persistence through self-updates and cleanup. The use of blockchain-based C2 discovery complicates detection and mitigation efforts. This can lead to significant compromise of victim systems and potential theft of cryptocurrency assets.

Defensive guidance

No specific patch or remediation is indicated. Since this is malware distributed via malicious Windows Installer packages masquerading as legitimate software, mitigation should focus on preventing installation of unauthorized software, employing endpoint detection and response solutions capable of identifying suspicious Node.js RAT behavior, and monitoring for unusual network connections, especially WebSocket communications to unknown endpoints. Investigate and block known malicious installer hashes and associated domains if available. There is no vendor patch as this is malware rather than a software vulnerability.

Summary

ChainScript is a Node.js-based remote access trojan discovered during an investigation into ClickFix. It employs deceptive Windows Installer packages to pose as legitimate applications. Its command and control infrastructure is dynamically located using an EtherHiding-style technique leveraging a Polygon blockchain smart contract, enabling flexible backend rotation via WebSocket connections. The RAT supports a broad range of capabilities such as interactive shell sessions, file management, screenshot capture, payload deployment, cryptocurrency wallet theft, remote JavaScript execution, self-updating, and cleanup functions. Multiple variants exist under different names but maintain consistent core functionality. The malware's use of blockchain for C2 discovery is notable for evading traditional detection and takedown methods.

Indicators of compromise

Domains 6

api-configuard.com
shift-api-control.com
bedotiq.net
giperon.net
kerosand.net
moweros.net

URLs 5

http://bedotiq.net:3854
http://giperon.net:3847
http://kerosand.net:3847
http://moweros.net:3851
http://shift-api-control.com:3847

IP addresses 2

176.65.144.40
176.65.144.127

Hashes 8

15d28d022a2417bf6e50030305ec6141
dc0e2d5cc6ed9524cef57de4e7183840b83b46b3
20a9e297220fe4cb9f939eaa82582c6e9a8f6dd4424635206dec08fa1986b8fa
496c202abf53984164f5f319a72b02c8e06016d0f35681353ef07db8e6d1b31f
6e07d2de3618bb92265248653361ff39c63c0cfba2f4aa2538b3128fa9ce3a50
7969ccaf1db750bc3b02d51626d6916ecbd0c0cf2f7de3c7bc0be240f5f2978d
9fa80577b8b3cb9c3062e5e1986cc9fe0c26eed023f7d430dfa5c60169c15c45
bad0600a850436154f8d7b6f7a191dc45bd136897780cd032b336cb4b358d241

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Oct 2026, 18:48 UTC

MITRE ATT&CK techniques21 from threat tags

Technical details