ChainScript Node.js RAT Leverages Polygon Blockchain for C2 via ClickFix Lures: OTX Pulse Analysis — Enterprise Detection Pack

Classification: TLP:WHITE | Intelligence Category: Active Malware Campaigns & Criminal Tooling | Analyst: Security Arsenal Threat Intelligence

Threat Summary

AlienVault OTX pulse data published 2026-10-18 documents ChainScript, a previously unnamed Node.js remote access trojan identified by Blackpoint's Adversary Pursuit Group during an investigation into ClickFix social-engineering activity. ChainScript represents a maturing convergence of two of the most operationally significant techniques observed in the crimeware ecosystem over the past two years: clipboard/instruction-paste social engineering (ClickFix) and blockchain-based C2 dead-dropping (EtherHiding).

The attack chain begins with ClickFix-style lures — fake browser update prompts, CAPTCHA verification pages, or error dialogs that instruct victims to paste and execute malicious commands. The lure ultimately delivers trojanized Windows Installer (MSI) packages impersonating legitimate productivity software, specifically Spotify, Zoom Workplace, and Microsoft Teams. Once installed, the Node.js-based RAT establishes its command-and-control channel by first querying a smart contract on the Polygon blockchain to retrieve its live C2 address — a technique that makes infrastructure takedowns significantly harder because the C2 pointer lives on an immutable, decentralized ledger rather than in a blocklistable domain or IP.

Post-compromise, ChainScript communicates over WebSocket-based C2 and is tasked with cryptocurrency wallet theft, consistent with financially motivated crimeware objectives. The pulse cross-references the Tsundere and EtherRAT families, indicating shared tooling, overlapping EtherHiding infrastructure, or a common developer/affiliate ecosystem. While no threat actor attribution or targeted-industry data is listed, the lure themes (collaboration software, media apps) indicate broad opportunistic targeting of both consumer and enterprise endpoints — any organization whose users can be induced to run an MSI or paste a command is in scope.

Objective: Financial gain via cryptocurrency wallet credential/key theft, with full RAT capability enabling follow-on payload delivery.

Threat Actor / Malware Profile

ChainScript (Node.js RAT)

Distribution Method

ClickFix lures are the entry point. Victims encounter a malicious or compromised webpage presenting a fake verification or error state, and are socially engineered into executing attacker-supplied commands (commonly via the Run dialog or a pasted PowerShell/msiexec invocation). The final delivery vehicle is a malicious MSI package branded as trusted software — Zoom, Teams, or Spotify — which lowers user suspicion and, critically, inherits the perceived legitimacy that MSI installers carry in enterprise environments. MSI execution through msiexec.exe also provides a signed, living-off-the-land parent process that naive EDR rules may exclude.

Payload Behavior

ChainScript is written in Node.js, giving the operator a cross-platform-capable, JavaScript-native toolkit. Observed tasking centers on cryptocurrency wallet theft: enumeration and exfiltration of browser extension wallet data (e.g., MetaMask, Phantom), desktop wallet files, clipboard hijacking of wallet addresses, and session/cookie theft against exchange web sessions. As a full RAT, it retains capability for arbitrary command execution, file transfer, and secondary payload staging.

C2 Communication

The defining characteristic is EtherHiding-style C2 discovery. Rather than hardcoding C2 infrastructure, the malware reads a smart contract on the Polygon network (via public RPC endpoints such as polygon-rpc.com or JSON-RPC API gateways) to retrieve its current C2 address. This provides three operational advantages to the adversary:

1. Takedown resistance — blockchain data is immutable and replicated; there is no server to seize.
2. Rapid rotation — the operator updates the contract, and all implants instantly resolve new C2.
3. Blend-in traffic — Polygon RPC calls look like ordinary Web3/HTTPS traffic.

The resolved C2 is then contacted over WebSocket, providing a persistent, full-duplex, low-latency channel that traverses proxies cleanly and avoids traditional HTTP beaconing signatures. The two domains in the pulse — api-configuard.com and shift-api-control.com — follow the API-mimicry naming convention typical of EtherHiding-adjacent infrastructure.

Persistence & Anti-Analysis

While the pulse does not enumerate persistence keys, MSI-delivered Node.js RATs of this class characteristically persist via HKCU\...\Run registry values, scheduled tasks, or Startup-folder LNK files pointing at node.exe with a script argument. EtherHiding itself functions as an anti-analysis technique: sandbox detonation without blockchain egress returns no live C2, and analysts must manually query the smart contract to map infrastructure. MSI packaging also buries malicious logic in custom actions, evading static file scanning of the final JavaScript payload.

IOC Analysis

The pulse contains 19 indicators across three types:

Operationalization guidance:

• Domains: Push to DNS firewall (RPZ), secure web gateway, and firewall blocklists. Because ChainScript resolves C2 dynamically via blockchain, the two named domains are point-in-time artifacts — treat them as confirmation evidence, not the full picture. Alerting on outbound JSON-RPC calls to public Polygon RPC endpoints from non-browser processes is the durable detection.
• Hashes: Ingest into Defender for Endpoint (Settings → Endpoints → Indicators → File hashes → Block), CrowdStrike custom IOCs, or equivalent. Sweep for historical file writes matching these hashes.
• Tooling to decode/validate: VirusTotal and MalwareBazaar for hash enrichment; OTX DirectConnect/API for pulse correlation; PolygonScan (read the contract's storage/transactions) to extract current C2 values from the EtherHiding contract; CyberChef for deobfuscating extracted JavaScript; msiexec /a or tools like lessmsi to extract and inspect MSI custom actions safely.

Detection Engineering

The following detections target the specific behaviors documented in this pulse: Node.js script execution spawned from MSI installers, ClickFix-style user-pasted command execution, and outbound blockchain RPC / WebSocket C2 communication.

---
title: ChainScript Node.js RAT - Script Execution from MSI Installer Context
id: 8f3a2c71-chain-4001-9001-c5a1n5cr1pt1
description: Detects node.exe or Node.js runtime execution spawned by msiexec.exe or referencing user-writable script paths, consistent with ChainScript delivery via trojanized MSI packages masquerading as Spotify, Zoom, or Teams.
status: experimental
date: 2026/10/18
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\msiexec.exe'
    selection_child:
        Image|endswith:
            - '\node.exe'
            - '\nodejs.exe'
    selection_path:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\ProgramData\'
            - '.js'
    condition: selection_parent and (selection_child or selection_path)
falsepositives:
    - Legitimate Node.js-based enterprise software deployed via MSI (rare)
level: high
tags:
    - attack.execution
    - attack.t1059.007
    - attack.t1203
---
title: ChainScript EtherHiding C2 - Outbound Polygon Blockchain RPC from Non-Browser Process
id: 8f3a2c71-chain-4002-9002-eth3rh1d1ng
description: Detects network connections to public Polygon RPC endpoints or known ChainScript C2 domains from non-browser processes. ChainScript queries a Polygon smart contract (EtherHiding technique) to resolve live WebSocket C2 infrastructure.
status: experimental
date: 2026/10/18
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'api-configuard.com'
            - 'shift-api-control.com'
            - 'polygon-rpc.com'
            - 'rpc-mainnet.matic'
            - 'matic-mainnet'
    selection_rpc_method:
        DestinationPort:
            - 443
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    condition: selection_domain and selection_rpc_method and not filter_browsers
falsepositives:
    - Web3-enabled desktop applications, crypto portfolio tools, trading bots
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
---
title: ClickFix Social Engineering - User-Pasted Command Execution via Run Dialog or Clipboard Spawn
id: 8f3a2c71-chain-4003-9003-cl1ckf1x00
description: Detects ClickFix-style execution where explorer.exe spawns script interpreters or msiexec with suspicious command lines, indicative of a user pasting attacker-supplied commands from a malicious lure page delivering ChainScript.
status: experimental
date: 2026/10/18
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\cmd.exe'
            - '\node.exe'
    selection_cl:
        CommandLine|contains:
            - 'Invoke-'
            - 'iex'
            - 'DownloadString'
            - 'http'
            - '/i http'
            - '.msi'
    condition: selection_parent and selection_child and selection_cl
falsepositives:
    - IT administrative software deployment via remote URLs
level: medium
tags:
    - attack.execution
    - attack.t1204.001
    - attack.t1059

The following Microsoft Sentinel KQL hunts for ChainScript network indicators, Polygon RPC egress from unexpected processes, and trojanized-software installation patterns.

// ChainScript / EtherHiding hunt: known C2 domains, Polygon RPC egress from non-browsers,
// and MSI-spawned script interpreter execution (ClickFix delivery pattern)
let KnownC2 = dynamic(["api-configuard.com", "shift-api-control.com"]);
let PolygonRPC = dynamic(["polygon-rpc.com", "rpc-mainnet.matic.network", "rpc-mainnet.matic.quiknode.pro", "polygon-mainnet.g.alchemy.com", "polygon.llamarpc.com"]);
let Browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe"]);
let NetworkHunt =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (KnownC2) or RemoteUrl has_any (PolygonRPC)
    | extend InitiatingFile = tolower(InitiatingProcessFileName)
    | extend IsBrowser = InitiatingFile in~ (Browsers)
    | extend HitType = case(
        RemoteUrl has_any (KnownC2), "Known ChainScript C2 Domain",
        IsBrowser == false, "Polygon RPC from Non-Browser Process",
        "Browser Polygon RPC (contextual)")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
              RemoteUrl, RemoteIP, RemotePort, HitType
    | order by HitType asc, TimeGenerated desc;
let ProcessHunt =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName =~ "msiexec.exe"
    | where FileName in~ ("node.exe", "powershell.exe", "cmd.exe", "mshta.exe")
       or ProcessCommandLine has_any (".js", "Invoke-", "DownloadString", "/i http")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
    | order by TimeGenerated desc;
union NetworkHunt, ProcessHunt

The following PowerShell script hunts endpoint artifacts associated with ChainScript: known file hashes, persistence entries referencing Node.js, recent MSI installations of trojanized software, and live WebSocket/C2 network connections.

# Security Arsenal - ChainScript Node.js RAT Endpoint IOC Hunt (2026-10-18)
# Run elevated. Checks hashes, persistence, MSI installs, and network state.

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. Known malicious file hashes (OTX pulse) ---
$BadHashes = @(
    '20a9e297220fe4cb9f939eaa82582c6e9a8f6dd4424635206dec08fa1986b8fa',
    '496c202abf53984164f5f319a72b02c8e06016d0f35681353ef07db8e6d1b31f',
    '6e07d2de3618bb92265248653361ff39c63c0cfba2f4aa2538b3128fa9ce3a50',
    '7969ccaf1db750bc3b02d51626d6916ecbd0c0cf2f7de3c7bc0be240f5f2978d'
)
$SearchPaths = @("$env:LOCALAPPDATA\Temp", "$env:APPDATA", 'C:\ProgramData')
foreach ($path in $SearchPaths) {
    Get-ChildItem -Path $path -Recurse -File -Include *.exe,*.js,*.msi -ErrorAction SilentlyContinue |
        ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            if ($BadHashes -contains $h) {
                $findings += [PSCustomObject]@{ Type='HASH MATCH'; Detail=$_.FullName; Hash=$h }
            }
        }
}

# --- 2. Persistence: Run keys & scheduled tasks referencing node.exe / .js ---
$RunKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $RunKeys) {
    Get-ItemProperty $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'node\.exe|\.js' } |
            ForEach-Object { $findings += [PSCustomObject]@{ Type='RUN KEY'; Detail="$key :: $($_.Name) = $($_.Value)"; Hash='' } }
    }
}
Get-ScheduledTask | ForEach-Object {
    $t = $_
    $t.Actions | Where-Object { "$($_.Execute) $($_.Arguments)" -match 'node\.exe|\.js' } |
        ForEach-Object { $findings += [PSCustomObject]@{ Type='SCHED TASK'; Detail="$($t.TaskName): $($_.Execute) $($_.Arguments)"; Hash='' } }
}

# --- 3. Recent MSI installs masquerading as Spotify/Zoom/Teams ---
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
    Where-Object { $_.DisplayName -match 'Spotify|Zoom Workplace|Microsoft Teams' -and
                   $_.InstallLocation -match 'AppData|Temp|ProgramData' } |
    ForEach-Object { $findings += [PSCustomObject]@{ Type='SUSPICIOUS INSTALL'; Detail="$($_.DisplayName) -> $($_.InstallLocation)"; Hash='' } }

# --- 4. Network: node.exe connections & known C2 domains ---
Get-NetTCPConnection -State Established | Where-Object {
    (Get-Process -Id $_.OwningProcess).ProcessName -match 'node'
} | ForEach-Object {
    $findings += [PSCustomObject]@{ Type='NODE.EXE NET'; Detail="PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort)"; Hash='' }
}
foreach ($dom in @('api-configuard.com','shift-api-control.com')) {
    $r = Resolve-DnsName $dom -ErrorAction SilentlyContinue
    if ($r) { $findings += [PSCustomObject]@{ Type='C2 DNS RESOLVES'; Detail="$dom -> $($r.IPAddress -join ', ')"; Hash='' } }
}

$findings | Format-Table -AutoSize
if ($findings.Count -eq 0) { Write-Host '[+] No ChainScript indicators found.' -ForegroundColor Green }
else { Write-Host "[!] $($findings.Count) finding(s) - escalate to IR." -ForegroundColor Red }

Response Priorities

Immediate (0–4 hours)

• Block indicators: Add api-configuard.com and shift-api-control.com to DNS RPZ, secure web gateway, and firewall blocklists. Push all SHA256/SHA1/MD5 hashes from the pulse to EDR block and quarantine policies (Defender for Endpoint custom indicators or equivalent).
• Retro-hunt: Run the KQL query and PowerShell hunt script across the estate; sweep 90 days of DNS/proxy logs for the known domains and for non-browser processes contacting public Polygon RPC endpoints (polygon-rpc.com, rpc-mainnet.matic.*, etc.).
• Isolate confirmed hosts: Any endpoint matching a hash or C2 domain should be network-isolated pending forensic triage — do not reimage before capturing memory (WebSocket C2 sessions and Node.js script content may exist only in memory).

24 Hours

• Credential and wallet exposure verification: ChainScript's documented objective is cryptocurrency wallet theft. On confirmed-compromised hosts, inventory installed browser wallet extensions (MetaMask, Phantom, Rabby, Coinbase Wallet) and desktop wallets; treat all seed phrases and keys as compromised and execute emergency fund migration where applicable.
• Session revocation: Force password resets and revoke active sessions/tokens for users of compromised hosts — wallet-extension theft frequently co-occurs with browser cookie and exchange-session theft. Invalidate OAuth grants and API keys stored on the endpoint.
• ClickFix exposure review: Query web proxy logs for users who visited lure pages around delivery timeframes; the same lure infrastructure typically hits multiple users in a campaign wave.

1 Week

• Application control: Implement WDAC/AppLocker policies restricting MSI installation to approved publishers, and block or constrain node.exe execution for standard users (Node.js has no legitimate reason to run on most enterprise workstations).
• Blockchain egress policy: Block outbound access to public blockchain RPC endpoints (Polygon, Ethereum, BSC) from non-approved processes at the proxy layer — there is almost no enterprise business case for arbitrary processes querying smart contracts.
• User hardening: Deploy technical mitigations against ClickFix: disable Win+R via GPO where feasible, and run targeted awareness training on paste-to-run lures. Audit MSI software-deployment practices so users expect software only from managed channels (Intune/SCCM), never from web downloads.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub