Threat actors are using ChainScript, a newly discovered remote access trojan that can rotate its infrastructure without rebuilding its implant.
Blackpoint researchers have watched the ChainScript remote access trojan switch to a new command server when its connection reset. Nothing changed in the malware already running on the infected machine.
The Node.js RAT reached victims through ClickFix, which led users to run a malicious Windows Installer package posing as legitimate software. The installer ran without administrator rights and the agent persisted at user level, through a scheduled task with a Run key fallback, so neither step needed elevation.
Justice-Hammer, an independent researcher, published the first public analysis of the malware on August 28 under the working name ComponentTask33. Blackpoint’s Adversary Pursuit Group published its own research on September 18, naming it ChainScript and identifying three further builds.
How the Server Switch Works
The agent looked up its command server from a Polygon smart contract rather than carrying a fixed address, which is what made the switch possible. It came about 30 minutes into Blackpoint’s controlled protocol analysis, when the session reset and the contract returned a different server.
The contract’s public record, read by Justice-Hammer, shows the operator changed the server it points to for the first time on August 31, twice in 16 minutes and three days after the researcher published.
A defender who recovers the contract address from a sample can watch each rotation as it happens, without contacting the attacker.
Blackpoint did not present the technique as new. It noted that Tsundere and EtherRAT combine Node.js, malicious installers and on-chain server discovery in similar ways, though it said the similarities do not establish a shared developer.
A Build Pipeline Behind the Lures
Blackpoint found four builds, ComponentTask33, UpdateDigital, HostShared and OrchidViolet66, posing as Spotify, Zoom Workplace and Microsoft Teams. The names and lures changed while the agent inside stayed recognizable.
Justice-Hammer found the resolver contract was deployed at 11:20:09 UTC on August 24, 23 seconds before the installer was built at 11:20:32.
The researcher said a gap that short could not be manual and pointed to an automated build pipeline, in which the contract address would be generated per build. That would also narrow what the public record reveals, since watching one contract shows rotations for only one build.
The agent also carries a wallet scanner that inventories installed wallets and reports only their names and paths. Blackpoint found no dedicated function for extracting seed phrases, keys, passwords or cookies, though it noted the agent’s shell and file access could be used to collect them manually.
What Defenders Can Still Detect
The two sources differ on which infrastructure indicators last. Blackpoint recommends treating domains, ports, IP addresses and contract addresses as short-lived.
Justice-Hammer found the hosting held. Every command domain in the August rotation resolved to the same address, which the researcher called “the durable control point,” and the wallet that deployed the contract survives both domain and contract changes.
Blackpoint’s own indicators place a newer build on a second address in the same network range, which Justice-Hammer had flagged as a pivot alongside the address itself.
For the malware itself, both lean on behavior. Blackpoint singled out unexpected Polygon or other EVM RPC traffic followed by node.exe opening an outbound WebSocket, which it said is more useful than either signal alone.
Justice-Hammer suggested flagging RPC calls from machines with no other cryptocurrency activity. Both warned against blocking public RPC services globally, which legitimate crypto applications rely on.
