ChainScript Node.js RAT Uses Polygon Contracts to Rotate WebSocket C2

Blackpoint Cyber identified ChainScript, a previously undocumented Node.js remote-access trojan delivered to Windows users through ClickFix social engineering and malicious MSI installers impersonating Spotify, Zoom Workplace, and Microsoft Teams. In one observed chain, victims were persuaded to run msiexec.exe, which retrieved a Spotify-themed MSI from api-configuard[.]com; the installer deployed a bundled Node.js runtime and JavaScript agent through hidden PowerShell and VBScript stages.

ChainScript persists at user level through a scheduled task, with a Registry Run-key fallback, and provides interactive CMD and PowerShell access, file operations, screenshots, payload delivery, arbitrary JavaScript execution, self-updating, cleanup, and cryptocurrency-wallet discovery. Its operators use an EtherHiding-style Polygon smart-contract lookup to resolve the active WebSocket C2 endpoint, allowing infrastructure to change without redeploying implants; researchers observed a live switch from shift-api-control[.]com:3847 to bedotiq[.]net:3854. Defenders should prioritize behavioral detections including msiexec.exe spawning script hosts, bundled node.exe making blockchain RPC requests, and subsequent WebSocket connections.