ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
-
Threat actors are using ClickFix-style lures to distribute a previously undocumented remote access trojan tracked as ChainScript, according to research from Blackpoint's Adversary Pursuit Group (APG).
The malware has been observed operating under several build names, which defenders should treat as potential indicators:
- ComponentTask33
- UpdateDigital
- HostShared
- OrchidViolet66
These builds masquerade as legitimate applications, including Spotify, Zoom Workplace, and Microsoft Teams, to blend into normal user activity and evade suspicion.
A notable element of the campaign is the use of Polygon to rotate command-and-control infrastructure, a technique that complicates blocking and takedown efforts by allowing the operators to shift C2 endpoints dynamically.
Source: The Hacker News
Has anyone seen these build names or the fake Spotify, Zoom Workplace, and Microsoft Teams installers in their environment yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login