Ethical Hacking News
ChainScript, a Node.js RAT that hides its command server inside a blockchain contract, has been identified as a sophisticated malware that exploits blockchain technology. This innovative approach has significant implications for cybersecurity defenders, who must now consider blockchain-based infrastructure discovery as a critical factor in identifying and mitigating attacks. As the malware uses a technique known as EtherHiding to find its command server, defenders must now look beyond traditional indicators such as domains and IP addresses to track and mitigate attacks.
ChainScript is a sophisticated malware that hides its command server inside a blockchain contract.The malware uses a technique called EtherHiding to find its command server, which involves querying a smart contract on the Polygon blockchain.The malware is deployed through a social engineering trick, where the victim is tricked into running a command that fires up a malicious installer.The malware provides attackers with full control of the infected computer, including a full interactive shell, file read and write access, and the ability to push additional payloads.The discovery of ChainScript highlights the evolving nature of malware design, where attackers are increasingly turning to blockchain technology to hide their command servers.Defenders should focus on tracking the chain of processes, rather than just domains and IP addresses, and watch for less obvious signs of activity, such as outbound blockchain RPC requests.
ChainScript, a Node.js remote access trojan (RAT), has been identified as a sophisticated malware that hides its command server inside a blockchain contract. This innovative approach to malware design has significant implications for cybersecurity defenders, who must now consider blockchain-based infrastructure discovery as a critical factor in identifying and mitigating attacks.
The malware, which was uncovered by Blackpoint's Adversary Pursuit Group, uses a technique known as EtherHiding to find its command server. This involves querying a smart contract on the Polygon blockchain for the address, which is then cached for five minutes and used to connect to the attacker's server. This approach allows the attackers to easily rotate the command server without having to update the malware itself.
The malware is deployed through a familiar trick: the victim is tricked into running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify. The installer then scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime. None of this needs admin rights, since the installer is set to run entirely within the user's own profile.
The main part of the malware is contained in a single file: app\src\index.js. This file handles the configuration, collects information about the infected computer, finds the command server, manages WebSocket connections, runs commands, updates the malware, and cleans things up. The other components, including the PowerShell and VBScript files and the helper binaries, are mainly there to launch this file and make sure it stays running.
Once connected, ChainScript hands operators a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function. That's complete control of the machine, with a cleanup command built in for when the job is done.
Blackpoint found the same agent wearing different outfits. Alongside the Spotify build, other versions turned up posing as Zoom Workplace and Microsoft Teams, each with its own package name but the same code underneath. The costume changes. The thing wearing it doesn’t.
The discovery of ChainScript highlights the evolving nature of malware design, where attackers are increasingly turning to blockchain technology to hide their command servers. This approach makes it much harder for defenders to track and mitigate attacks, as the command server can be easily rotated without having to update the malware itself.
For defenders, this changes where they should focus their attention. Tracking domains and IP addresses is still useful, but those indicators may not stay valid for long if the attackers can simply change the blockchain contract. Looking at the chain of processes can be much more effective: msiexec starting, wscript, wscript launching the VBScript, and node.exe running app\src\index.js. These relationships are much harder for attackers to change than the server address they happen to be using this week.
Defenders should also watch for less obvious signs of activity. For example, a node.exe process suddenly making outbound blockchain RPC requests and then opening a WebSocket connection should attract attention. Neither of these behaviors is necessarily malicious on its own. But when they happen together, they become a much stronger indicator of compromise than simply looking for a specific domain or IP address on a blocklist.
"ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain-based infrastructure discovery," concludes the report. This innovative approach to malware design has significant implications for cybersecurity defenders, who must now consider blockchain-based infrastructure discovery as a critical factor in identifying and mitigating attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-ChainScript-A-Sophisticated-RAT-that-Exploits-Blockchain-Technology-ehn.shtml
https://securityaffairs.com/199471/malware/chainscript-the-rat-that-hides-its-command-server-inside-a-blockchain-contract.html
https://securityaffairs.com/199471/uncategorized/chainscript-the-rat-that-hides-its-command-server-inside-a-blockchain-contract.html
https://blackpointcyber.com/blog/chainscript-tracing-a-nodejs-rat-across-the-blockchain/
https://undercodenews.com/chainscript-and-the-new-clickfix-era-how-blockchain-backed-malware-is-turning-trusted-software-into-a-gateway-for-remote-control-video/
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html
https://blackpointcyber.com/why-blackpoint/adversary-pursuit-group/
https://blackpointcyber.com/threat-intelligence-and-research/
Published: Mon Sep 21 09:33:31 2026 by llama3.2 3B Q4_K_M
