ChainScript RAT Hides Its Command Servers Behind a Polygon Smart Contract
Researchers have identified new Windows malware dubbed ChainScript RAT that uses a Polygon blockchain smart contract to discover its active command servers. Delivered through ClickFix lures, the tool gives attackers remote shell access, file control, screenshots, payload deployment and remote JavaScript execution on infected machines.
A newly documented piece of malware is using a public blockchain as its coordination layer, complicating efforts to shut it down. ChainScript RAT, a remote access trojan targeting Windows systems, reaches out to a smart contract on the Polygon network to learn where its command‑and‑control servers are, according to a technical report.
Infections typically begin with ClickFix lures, which are files or links designed to look like legitimate fixes or updates but instead deliver a malicious executable. Once a victim runs the file, the malware installs itself and then queries a specific smart contract on Polygon. Instead of embedding static server addresses in the code or generating domains through an algorithm, the operators can update server information by changing data stored in that smart contract.
From the victim’s perspective, the capabilities are familiar but serious. ChainScript RAT allows attackers to run shell commands, browse and manipulate files, take screenshots and drop additional payloads. It also supports remote JavaScript execution, which can be used to interfere with browser activity or extend attacks in other ways. With these tools, an intruder can exercise broad control over the compromised system.
What stands out is the way the control channel is maintained. Traditional takedown efforts often focus on suspending domains or disrupting hosting for command servers. In this case, key configuration details are pulled from a smart contract replicated across the Polygon network. Because such contracts are designed to be persistent and resistant to unilateral changes, defenders can’t simply ask a registrar or hosting provider to remove the infrastructure that ChainScript uses to stay updated.
For corporate security teams, that design means standard blacklists and sinkholes are only part of the answer. The malware still has to connect to real servers, which can be blocked, but the resilience and flexibility provided by a blockchain‑based coordination point give attackers more room to move servers without changing the malware itself. Requests to the smart contract can also blend into ordinary blockchain traffic, making them harder to distinguish at a glance.
ChainScript RAT fits into a broader pattern in which attackers co‑opt legitimate, decentralized services to hide their operations. Other campaigns have abused social media, public code repositories or other infrastructure to distribute configuration data. Using a smart contract on a major blockchain is an extension of that trend, taking advantage of decentralization and persistence that were designed for entirely different purposes.
For now, defenders will be watching to see whether ChainScript remains a niche tool or is adopted more widely. Signals that it’s spreading could include the appearance of copycat malware querying the same Polygon contract, signs that more sophisticated groups are experimenting with similar techniques, and updates to detection rules that focus on both the ClickFix delivery lures and the specific blockchain interactions involved.
The more attackers embed their instructions in public ledgers and other decentralized systems, the more everyday threat hunting will have to include those environments alongside traditional domain and IP monitoring.
Sources
- OSINT