ChainScript is a Node.js-based remote access trojan that employs a novel EtherHiding-style C2 discovery mechanism leveraging a Polygon blockchain smart contract to locate active WebSocket C2 servers dynamically. This technique enables backend service rotation without agent redeployment. The malware is distributed via malicious Windows Installer packages disguised as popular legitimate applications. It provides comprehensive remote control capabilities such as interactive shell sessions, file management, screenshots, payload deployment, cryptocurrency wallet theft, remote JavaScript execution, self-updates, and cleanup routines. Multiple variants with different names maintain a consistent agent core. The threat was uncovered during an investigation into ClickFix and includes a range of IoCs like IP addresses, domains, URLs, and file hashes.

The malware enables attackers to gain persistent and flexible remote access to infected systems, including the ability to execute arbitrary commands, manipulate files, capture screenshots, deploy additional payloads, and steal cryptocurrency wallets. The use of blockchain-based C2 discovery complicates detection and takedown efforts by allowing dynamic backend rotation. This can lead to significant data theft, system compromise, and potential financial loss through cryptocurrency theft.

No official patch or remediation is available as this is malware rather than a software vulnerability. Mitigation should focus on detection and removal of the malware using updated endpoint protection solutions and network monitoring for the provided indicators of compromise (IPs, domains, hashes, URLs). Organizations should be cautious of Windows Installer packages masquerading as legitimate software and validate software sources. Since the malware uses blockchain-based C2 discovery, traditional C2 blocking may be less effective, so behavioral detection and threat hunting are recommended.