ChainScript RAT resolves its command channel through a Polygon smart contract

Blackpoint described the design in its own words. "By separating backend discovery from the malware itself and using the Polygon contract as an external resolver, the operator can redirect infected hosts to new infrastructure while retaining the same implant and reconnect workflow," the company said ^[10]. The researchers place it in a wider trend: "ChainScript reflects an emerging pattern of malware using development frameworks and blockchain-based C2 discovery to enable infrastructure rotation and complicate traditional indicator-based detection" ^[9].

The WebSocket tier is therefore cheap for the operator to change. A domain or address list for it is accurate until the operator writes a new value into the contract ^[3], and the lookup itself has no registrar or hosting provider to serve with a takedown notice.

The execution chain does not rotate the same way. msiexec.exe runs an installer named ComponentTask33-4d14e6ac.msi that presents itself as Spotify, drops the Node.js runtime, and launches the JavaScript agent through hidden PowerShell and VBScript stages ^[5]. The PowerShell stage writes the runtime, the agent source, the configuration and auxiliary binaries into Microsoft-looking paths under %LOCALAPPDATA%, and the VBScript is the launcher ^[6]. The agent then keeps itself alive with a user-level scheduled task, falling back to a Registry Run key ^[7]. Each of those is a sequence a defender can watch for: msiexec fetching a remote package, PowerShell writing node.exe into a user profile directory, a script host opening a WebSocket.

The front end of these campaigns is working well enough to justify the engineering. Threat actors ran 108 malicious ads from HBO Max's verified Reddit account over 48 hours in mid-September 2026 ^[12], a rate of about 2.25 an hour sustained for two days ^[18]. On macOS the pages delivered MacSync, Atomic macOS Stealer and fake wallet applications built to capture recovery phrases; on Windows, Amatera Stealer plus the AnimateClipper and ZigClipper clippers ^[13]. Hudson Rock, which named the activity PasteSwitch together with ADAMnetworks ^[11], said: "By hijacking a verified corporate account, they bypassed the initial skepticism many users apply to internet advertisements" ^[15]. How the account was taken over, and how many people were infected, is not known ^[14].

A separate ClickFix run uses a fake Codex download surfaced through search results, sending macOS visitors to Google Sites pages that instruct them to paste a command into Terminal, which executes Atomic Stealer; visitors on other platforms get a harmless decoy page ^[20]. Seqrite Labs puts MacSync infections heaviest in the United States, then the United Kingdom, Germany, Japan, Canada, France, Singapore, Australia, India and the Netherlands ^[16]. "MacSync campaigns primarily target regions with widespread macOS enterprise use, tech and software development sectors, and active cryptocurrency or Web3 communities," researcher Chandra Kant Bauri said ^[17].

Every infected host has to read the same contract ^[3]. That makes the contract address the most stable value in the whole chain, and the published account of the research does not include it, nor a count of ChainScript infections ^[19].