ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

As cited

Copy frozen at 2026-09-21 11:14 UTC (site build).

threat intel

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are using ClickFix-style lures to distribute ChainScript, a previously undocumented remote access trojan (RAT) that masquerades as legitimate software including Spotify, Zoom Workplace, and Microsoft Teams. The malware operates under multiple build names such as ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, and leverages Polygon blockchain infrastructure to rotate its command and control (C2) endpoints.

Why it matters: Organizations and users need to recognize ClickFix-style social engineering tactics and validate software authenticity, as this RAT provides attackers interactive system access for espionage, data theft, and lateral movement.

Source published

2026-09-21 08:39 UTC

First seen by Cybersecurity Tracker

2026-09-21 09:51 UTC