A newly documented remote access trojan called ChainScript is spreading through ClickFix-style lures disguised as Spotify, Zoom, and Microsoft Teams installers. The interesting part isn’t the trojan itself, it’s how it finds its command server: instead of a hardcoded address, ChainScript pulls the current server location from a smart contract on the Polygon blockchain, letting operators rotate infrastructure without touching the malware on infected machines. Around the same time, researchers documented a much larger campaign that started with a compromised HBO Max Reddit account and used the same ClickFix technique to push macOS and Windows stealers through paid ads.
Why ClickFix keeps working
ClickFix isn’t an exploit. It’s social engineering that skips the exploit entirely. A visitor hits a fake error, a video that won’t play, a CAPTCHA that won’t clear, an app that “needs an update”, and the fix is always the same: copy a command, paste it into a terminal or Run dialog, hit enter. The user does the damage themselves, with their own hands, which is exactly why antivirus tooling struggles here. From the operating system’s point of view, a legitimate user just launched a legitimate shell.
The technique has been documented for years by Malwarebytes, Push Security, and Trend Micro, and it isn’t slowing down. Microsoft found more than 250 look-alike domains earlier this year running the same ClickFix pattern specifically against macOS users.
How ChainScript gets on the machine
The lure poses as Spotify. The victim downloads an MSI package, something like ComponentTask33-4d14e6ac.msi, and runs it through the standard msiexec.exe. A PowerShell stage then quietly lays down a Node.js runtime, the agent’s source, configuration, and supporting binaries across several %LOCALAPPDATA% paths. A final VBScript launches the actual ChainScript agent, written in JavaScript, and locks in persistence through a scheduled task and a Registry Run key.
From there the agent opens a WebSocket connection back to its operator and hands over direct control of the machine.
A command server hidden in a smart contract
The distinctive part of this campaign isn’t the trojan’s capabilities, it’s how it locates its own infrastructure. Rather than embedding a server address in the code, ChainScript queries a Polygon smart contract and reads back the current WebSocket endpoint. Researchers are calling this pattern EtherHiding. A blockchain can’t be seized or sinkholed the way a domain or an IP address can, and operators can rotate their entire C2 infrastructure with a single contract transaction, without ever touching the malware already sitting on victim machines. For defenders, that means indicator-based blocking loses most of its value here: today’s C2 address can be dead tomorrow while the smart contract itself keeps running untouched.
This isn’t a first for blockchain-anchored infrastructure on this blog either. We covered the same underlying idea in the ChainDrop npm worm, which anchored its command infrastructure to Ethereum instead of Polygon. The chain changes, the resilience logic behind it doesn’t.
What ChainScript can do once it’s in
The capability list is fairly standard for a modern RAT, but complete:
- interactive command execution through CMD and PowerShell;
- file operations on the victim’s disk;
- screenshot capture;
- fetching and running additional payloads;
- enumerating cryptocurrency wallets, both desktop applications and browser extensions;
- remote execution of arbitrary JavaScript;
- self-update, and, if needed, removing its own traces from the system.
The lures didn’t stop at Spotify. Zoom Workplace and Microsoft Teams branding were used too, software that gets installed in most companies without ever going through IT.
PasteSwitch: how a hijacked HBO Max Reddit account became an ad pipeline
Separately, Blackpoint’s Adversary Pursuit Group documented a related but distinct campaign codenamed PasteSwitch. In mid-September 2026, someone gained access to HBO Max’s official Reddit account (u/hbomax) and ran 108 malicious ads through it over 48 hours.
macOS visitors were served fake installers that delivered a stealer called MacSync, the well-known Atomic macOS Stealer (AMOS), and fraudulent crypto wallet apps. Windows visitors got a different bundle: Amatera Stealer, AnimateClipper, and ZigClipper. MacSync infections concentrated in the US, UK, Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands, a spread that tracks closely with where enterprise Mac usage, software development, and active crypto communities overlap. ADAMnetworks independently corroborated the campaign, and Hudson Rock was first to spot the compromised account.
A separate ClickFix variant, unconnected to HBO Max, turned up in Cato Networks’ research: a fake Codex download page in search results led to a bogus Google Sites page, which in turn ran a three-stage shell script chain that delivered Atomic Stealer. Seqrite Labs, credited to researcher Chandra Kant Bauri, found that several of these macOS-targeted campaigns fingerprint the visitor’s browser before serving the payload, so the real infection stage never reaches automated scanners or researchers browsing from the wrong environment.
Our take
ClickFix keeps working for one simple reason: it targets a user’s judgment at the exact moment they’re frustrated, not a technical control. Someone whose video won’t play or whose CAPTCHA won’t clear wants the problem solved right now, and will follow instructions that look like ordinary tech support without a second thought. Security awareness training helps here more than most technical controls, but training is a point-in-time thing while these campaigns keep evolving their pretext. Over the past year alone, ClickFix has hidden behind fake CAPTCHAs, fake browser updates, and now, as in this case, fake installers for mainstream software.
Moving C2 infrastructure onto a blockchain is a logical next step for malware operators who’ve spent years losing ground to domain and IP takedowns fed by threat intel feeds. A smart contract removes that entire problem for them. Expect other malware families to adopt the same pattern within the next year, this won’t stay a ChainScript-only trick.
What to actually do about it
- Restrict clipboard-to-shell execution in PowerShell and terminal apps for standard users wherever that’s technically feasible, and train staff to never run a “fix” command a website tells them to paste.
- Get honest visibility into how software like Zoom and Teams actually gets installed in your organization outside of IT-managed channels, since that’s the exact cover these campaigns rely on.
- If crypto wallets, desktop or browser-based, exist anywhere in the organization, isolate them on a dedicated machine. ChainScript and stealers like AMOS are built specifically to find them.
- Run a real social engineering assessment to find out whether a lure like this would actually work on your people, before an attacker runs that test for you.
- Pair it with a phishing simulation campaign built around the current pretext, not last year’s, since ClickFix lures change their disguise every few months.
- If you already suspect a machine is compromised, don’t start with a reimage. Run an assumed breach assessment first to understand what access the attacker actually had before you destroy the evidence.