Chandra Kant Bauri

ChainScript RAT resolves its command channel through a Polygon smart contract

Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.