As reported by SecurityAffairs, Blackpoint's Adversary Pursuit Group has uncovered ChainScript — a Node.js-based remote access trojan that resolves its command-and-control infrastructure by querying a smart contract deployed on the Polygon blockchain. This is not a theoretical exercise in blockchain abuse. It is a working, field-deployed RAT distributed through an active ClickFix social engineering campaign, and it demands attention from defenders who may not yet have blockchain-aware monitoring on their roadmap.

Threat Alert: As reported by SecurityAffairs, Blackpoint's Adversary Pursuit Group has uncovered ChainScript — a Node.js-based remote access trojan that resolves its command-and-control infrastructure by querying a smart contract deployed on the Polygon blockchain.

Why Blockchain-Based C2 Changes the Threat Landscape

The core innovation here is not the malware itself — Node.js RATs are trivial to build and increasingly common. The significance lies in the infrastructure resilience model. Traditional C2 domains and IP addresses can be sinkholed, seized, or blocked at the perimeter. A smart contract address on a public blockchain cannot be seized by any single entity. The attacker updates a single contract variable, and every infected client picks up the new WebSocket endpoint within five minutes. No recompilation, no redistribution, no reinfection required.

This is the operationalization of EtherHiding at production scale. The gap between proof-of-concept and weaponized deployment has now closed.

For defenders, this means that traditional IOC-based blocking — domain blacklists, IP reputation feeds, firewall rules — are structurally insufficient against this class of threat. You can block the blockchain RPC endpoint the malware queries, but there are dozens of public Polygon RPC providers, and the malware can be trivially modified to cycle through them. You can block the specific contract address, but deploying a new contract costs cents and takes seconds.

The Infection Chain: Low and Slow

The delivery mechanism follows the now well-documented ClickFix pattern: social engineering that convinces a user to paste and execute a command. What makes ChainScript's post-exploitation notable is its reliance on living-off-the-land execution chains — PowerShell to VBScript to a bundled Node.js runtime — all running within the user's profile without requiring elevation. The malware masquerades its components in Microsoft-sounding directory names, a technique that blends into legitimate system noise.

The entire payload is consolidated into a single file (app/src/index.js), which handles reconnaissance, C2 resolution, command execution, self-update, and cleanup. This monolithic design is both a strength (easy to deploy and update) and a weakness (a single detection signature can neutralize the entire toolchain).

Who Is at Risk

The Infection Chain: Low and Slow
End-user-heavy organizations where employees have latitude to install software or run commands — the ClickFix vector relies on user initiative, not software vulnerabilities.
Environments without application allowlisting — ChainScript's use of msiexec.exe, PowerShell, and cscript.exe are all standard system binaries that execute freely on most workstations.
Teams without blockchain egress monitoring — if your SIEM or network monitoring does not flag traffic to public RPC endpoints (Infura, Alchemy, QuickNode, etc.), this C2 channel is invisible.

Shield53 Recommendations

Immediate Actions

  • Deploy detection rules for outbound traffic to known Polygon RPC endpoints (RPC URLs matching patterns for public providers) originating from non-developer workstations. This is your highest-signal indicator.
  • Hunt for the execution chain: Search EDR telemetry for the specific sequence msiexec.exe → powershell.exe → cscript.exe → node.exe within a single process tree, especially when node.exe runs from a user-profile directory.
  • Block the known contract address 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 at any blockchain API gateways your organization uses, while recognizing this is a stopgap, not a solution.
  • Search for app\src\index.js in user profile directories — this static path is a reliable filesystem IOC for the current build.

Strategic Actions

  • Add blockchain RPC endpoints to your proxy blocklists for non-developer VLANs. Most enterprise users have no legitimate reason to query Ethereum or Polygon RPC nodes directly.
  • Implement application allowlisting for Node.js runtimes. Legitimate enterprise use of Node on endpoints is rare; blocking unsigned node.exe executions from user-writable paths would have stopped this campaign entirely.
  • Build blockchain-aware threat hunting into your SOC playbooks. EtherHiding has been documented since at least 2023. ChainScript will not be the last implementation. Analysts need procedures for querying contract state on public chains and correlating contract addresses with endpoint telemetry.
  • Reinforce ClickFix awareness training. The initial compromise still requires user action. The technical sophistication of the payload is irrelevant if the social engineering fails.

Detection Pseudocode

For EDR or SIEM rule creation, target this behavior pattern:

  • Process: node.exe with parent cscript.exe or wscript.exe
  • Network: outbound TLS to *.infura.io, *.alchemy.com, *.quicknode.com, or direct calls to polygon-rpc.com
  • File: creation of index.js under %USERPROFILE%\AppData\ in a directory with a Microsoft-sounding name

The broader implication is clear: public blockchains are now operational C2 infrastructure, not just a funding mechanism. Security programs that treat blockchain as irrelevant to endpoint defense are operating with an increasingly dangerous blind spot. ChainScript is not sophisticated malware — it is resilient malware, and resilience is what defeats most defensive postures over time.