<![CDATA[ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure]]>Threat actors are using ClickFix-style lures to distribute a previously undocumented remote access trojan tracked as ChainScript, according to research from Blackpoint's Adversary Pursuit Group (APG).

The malware has been observed operating under several build names, which defenders should treat as potential indicators:

  • ComponentTask33
  • UpdateDigital
  • HostShared
  • OrchidViolet66

These builds masquerade as legitimate applications, including Spotify, Zoom Workplace, and Microsoft Teams, to blend into normal user activity and evade suspicion.

A notable element of the campaign is the use of Polygon to rotate command-and-control infrastructure, a technique that complicates blocking and takedown efforts by allowing the operators to shift C2 endpoints dynamically.

Source: The Hacker News

Has anyone seen these build names or the fake Spotify, Zoom Workplace, and Microsoft Teams installers in their environment yet?

]]>https://xploitlk.com/topic/413/clickfix-lures-deploy-chainscript-rat-using-polygon-to-rotate-c2-infrastructureRSS for NodeTue, 27 Oct 2026 08:15:52 GMTMon, 21 Sep 2026 10:30:19 GMT60