Threats Tagged 'chainscript'
View all threats tagged with 'chainscript'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'chainscript'
Click on any threat for detailed analysis and mitigation recommendations
ChainScript is a Node.js remote access trojan (RAT) identified by Blackpoint's Adversary Pursuit Group during the ClickFix investigation. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams using malicious Windows Installer packages. The malware uses a Polygon blockchain smart contract to dynamically discover its command and control (C2) infrastructure via WebSocket connections, allowing operators to rotate backend services without rebuilding agents. ChainScript offers extensive remote access features including shell access, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-updating, and cleanup. Multiple builds with different names share the same core architecture. Indicators include IPs, domains, hashes, and URLs associated with the malware infrastructure. Join the discussion | AlienVault OTX General | 09/18/2026, 21:49:13 UTC Added: 09/21/2026, 08:46:37 UTC |
Showing 1 to 1 of 1 result