other

ChainScript

Windows remote access trojan implemented as a JavaScript agent running on a bundled Node.js runtime, first documented publicly in 2026, which resolves its command server through a Polygon smart contract.

Known aliases

ComponentTask33
HostShared
OrchidViolet66
UpdateDigital

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

ChainScript RAT resolves its command channel through a Polygon smart contract

Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.

Publishers:thehackernews.com

Reality

Evidence60
Adoption45
Hype gap+10
Incentives70
Confidence55