ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers

Blackpoint Cyber’s Adversary Pursuit Group analyzed a ClickFix campaign that delivered a Node.js RAT named ChainScript via a fake Spotify MSI; the installer drops a bundled Node.js runtime and agent, establishes persistence (scheduled task and Run key), and provides attackers with interactive shells, file operations, screenshots, payload execution, updates, and wallet discovery. Uniquely, ChainScript queries a Polygon smart contract to resolve the active WebSocket C2 address (cached for five minutes), allowing operators to move C2 infrastructure without modifying deployed agents; researchers observed live infrastructure and resolver behavior pointing to specific C2 hosts and build timing that suggests automated contract deployment.