Researchers at Blackpoint's Adversary Pursuit Group have detailed a previously undocumented remote access trojan called ChainScript, delivered through ClickFix-style lures. The malware has surfaced under build names including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, disguised as Spotify, Zoom Workplace, and Microsoft Teams.

ChainScript uses an EtherHiding-style technique, relying on a Polygon smart contract to locate its active WebSocket command-and-control infrastructure. Once installed, it offers interactive CMD and PowerShell access, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration, and remote JavaScript execution.

The attack begins with a ClickFix lure that downloads a malicious Windows installer run via msiexec.exe. That installer deploys the Node.js runtime and launches the ChainScript JavaScript agent through hidden PowerShell and VBScript stages, dropping components into Microsoft-looking paths under %LOCALAPPDATA%. The agent establishes user-level persistence through a scheduled task with a Registry Run key fallback, then connects to its C2 over WebSockets for tasking, self-updates, and persistence removal.

Blackpoint said the approach reflects a growing pattern of malware using development frameworks and blockchain-based C2 discovery to rotate infrastructure and complicate indicator-based detection, separating backend discovery from the implant so operators can redirect infected hosts while keeping the same reconnect workflow.

Separately, Hudson Rock and ADAMnetworks reported that attackers compromised HBO Max's official Reddit account and used it to serve 108 malicious ads over 48 hours in mid-September 2026, pushing ClickFix attacks under the codename PasteSwitch. On macOS, the campaign delivered MacSync, Atomic macOS Stealer, and fake cryptocurrency wallet apps; on Windows, Amatera Stealer and clippers including AnimateClipper and ZigClipper. It is unknown how the account was breached or how many users were compromised.

Seqrite Labs reported MacSync infections concentrated in the U.S., U.K., Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands. Another ClickFix campaign uses a fake Codex download surfaced through search results, directing macOS users to bogus Google Sites pages that execute Atomic Stealer via a copied Terminal command, while non-Mac visitors see a decoy page. Microsoft previously observed a macOS ClickFix campaign using at least 250 look-alike domains and a server-side browser-fingerprinting gate to limit visibility for crawlers and sandboxes.

Source: The Hackers News