ChainScript is a Node.js remote access trojan (RAT) identified by Blackpoint's Adversary Pursuit Group. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams via malicious Windows Installer packages. The malware uses a Polygon blockchain smart contract to dynamically discover its command and control (C2) infrastructure, allowing operators to rotate backend services without rebuilding agents. ChainScript offers extensive remote access features including shell access, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-updating, and cleanup. Multiple builds with different names share the same core architecture.