ChainScript RAT Deployed via ClickFix Lures with Polygon Blockchain C2 Rotation — Detection and Response Guide

---
title: ClickFix User-Driven Execution via Run Dialog
description: Detects script interpreters and LOLBins spawned by explorer.exe, consistent with a victim pasting a malicious command into the Windows Run dialog after a ClickFix clipboard lure.
references:
  - https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/09/10
status: experimental
id: 3f8c2a71-9b4d-4e6a-a1c5-7d2e9f0b1a34
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\wmic.exe'
      - '\cmd.exe'
  selection_flags:
    CommandLine|contains:
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' -enc '
      - ' -ec '
      - 'FromBase64String'
      - 'http://'
      - 'https://'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'mshta http'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Power users and administrators running one-liners via Run dialog; tune with user and command allowlists
level: high
---
title: ChainScript RAT Masquerading as Spotify Zoom or Teams in User-Writable Paths
description: Detects processes using Spotify, Zoom, or Microsoft Teams product naming executing from user-writable or temporary directories, consistent with ChainScript build artifacts (ComponentTask33, UpdateDigital, HostShared, OrchidViolet66).
references:
  - https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html
  - https://attack.mitre.org/techniques/T1036/005/
author: Security Arsenal
date: 2026/09/10
status: experimental
id: 8a1d4e62-5c7b-4f39-b2d8-6e0a3c1f9b27
tags:
  - attack.defense_evasion
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_names:
    OriginalFileName|contains:
      - 'ComponentTask33'
      - 'UpdateDigital'
      - 'HostShared'
      - 'OrchidViolet66'
  selection_spoof:
    Image|contains:
      - 'spotify'
      - 'zoom'
      - 'teams'
  selection_paths:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Downloads\'
  condition: selection_names or (selection_spoof and selection_paths)
falsepositives:
  - Legitimate Zoom/Teams/Spotify installers run from Downloads during initial install; correlate with signature status and parent process
level: high
---
title: Non-Browser Process Connecting to Polygon Blockchain RPC Endpoints
description: Detects non-browser processes establishing network connections to public Polygon RPC endpoints, consistent with ChainScript resolving C2 infrastructure from on-chain data. Most enterprise endpoints have no legitimate reason to query blockchain RPC nodes.
references:
  - https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/09/10
status: experimental
id: 5c9e7f13-2a6d-4b8e-91f4-3d7c0e5a6b98
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'polygon-rpc.com'
      - 'polygon.llamarpc.com'
      - 'rpc-mainnet.matic.network'
      - 'polygon-mainnet'
      - 'matic-mainnet'
      - 'polygon.drpc.org'
      - 'polygon.api.onfinality.io'
      - 'polygon-mainnet.public.blastapi.io'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection_dest and not filter_browsers
falsepositives:
  - Cryptocurrency wallet or web3 developer tooling; if your org has none of these, this rule should be near-silent
level: high

// Hunt: ClickFix execution chain + blockchain RPC C2 resolution
// Part 1: Run-dialog-spawned script interpreters (ClickFix paste execution)
let ClickFixExec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "curl.exe", "wmic.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-w hidden", "windowstyle hidden", "-enc", "FromBase64String", "IEX", "Invoke-Expression", "DownloadString", "http://", "https://")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, ReportId;
// Part 2: Non-browser connections to Polygon RPC infrastructure
let PolygonC2 = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("polygon-rpc.com", "polygon.llamarpc.com", "rpc-mainnet.matic.network", "polygon.drpc.org", "polygon-mainnet.public.blastapi.io", "matic-mainnet")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// Union and correlate by device within a 4-hour window
ClickFixExec
| join kind=inner (PolygonC2) on DeviceName
| where abs(datetime_diff('minute', TimeGenerated1, TimeGenerated)) <= 240
| project DeviceName, ClickFixTime=TimeGenerated, C2Time=TimeGenerated1, AccountName, ClickFixCommand=ProcessCommandLine, RPCProcess=InitiatingProcessFileName1, RPCCommand=InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by ClickFixTime desc

-- Hunt for ChainScript staging artifacts and blockchain RPC C2 connections
-- Scope: endpoints with script interpreters spawned by explorer (ClickFix pattern)
-- and any non-browser process holding connections to Polygon RPC endpoints.

-- Stage 1: Suspicious processes in user-writable paths with spoofed naming
LET suspect_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ '(?i)(appdata|programdata|users\\\\public|downloads)'
   AND (Exe =~ '(?i)(spotify|zoom|teams|componenttask|updatedigital|hostshared|orchidviolet)'))
   OR CommandLine =~ '(?i)(frombase64string|invoke-expression|downloadstring)'

SELECT * FROM suspect_procs

-- Stage 2 (run separately if collector supports it): live netstat for blockchain RPC
-- SELECT Pid, Name, RemoteAddr, RemotePort, Status
-- FROM netstat()
-- WHERE RemoteAddr =~ 'polygon|matic|ankr|llamarpc|drpc|blastapi'
--   AND Name !~ '(?i)(chrome|msedge|firefox|brave|opera)'

# ChainScript / ClickFix endpoint audit and hardening script
# Run as Administrator. Audit-only by default; set $Enforce = $true to apply controls.
$Enforce = $false
$report = [ordered]@{}

# 1. Check for processes masquerading as trusted apps in user-writable paths
$spoofed = Get-CimInstance Win32_Process | Where-Object {
    ($_.ExecutablePath -match '(?i)(appdata|programdata|users\\public|downloads)') -and
    ($_.Name -match '(?i)(spotify|zoom|teams)') -or
    ($_.CommandLine -match '(?i)(componenttask33|updatedigital|hostshared|orchidviolet66)')
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine
$report['SpoofedProcesses'] = $spoofed

# 2. Review RunMRU for pasted ClickFix-style commands (per-user artifact)
$runMru = Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -ErrorAction SilentlyContinue |
    Get-ItemProperty | Select-Object -Property * -ExcludeProperty PS* | Out-String
$report['RunMRU'] = $runMru

# 3. Check persistence locations for suspicious entries
$runKeys = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
$persist = foreach ($k in $runKeys) {
    if (Test-Path $k) {
        Get-ItemProperty $k | Select-Object -Property * -ExcludeProperty PS* |
            ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match '(?i)(appdata|temp|programdata|powershell|mshta)' } |
                Select-Object @{n='Key';e={$k}}, Name, Value }
    }
}
$report['SuspiciousPersistence'] = $persist

# 4. Verify ASR rule state (Block executable content from email/web is minimum baseline)
$asr = Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids -ErrorAction SilentlyContinue
$report['ASRRulesConfigured'] = [bool]$asr

# 5. Enforce: block mshta/powershell launched from explorer via WDAC is heavy;
#    lighter lift — enable PowerShell Script Block Logging and AMSI if not present
if ($Enforce) {
    New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1
    Write-Host '[+] PowerShell Script Block Logging enabled.' -ForegroundColor Green
}

$report | ConvertTo-Json -Depth 5