Security researchers have spotted a new remote access trojan dubbed ChainScript being delivered through ClickFix-like lures. These lures trick users into pasting malicious commands or clicking through fake browser-update prompts, a technique that has become increasingly common in recent campaigns.
ChainScript has been observed in the wild under several build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66. The variety of names suggests the operators are actively iterating on the malware or running multiple parallel campaigns using the same underlying toolset.
A notable feature of ChainScript is its use of the Polygon blockchain to rotate command-and-control (C2) infrastructure. By anchoring C2 addresses or configuration data on-chain, the attackers can dynamically update their servers without changing the malware binary, making it harder for defenders to block or take down the infrastructure.