ChainScript malware uses Polygon contract to rotate control servers

Security researchers have identified ChainScript, a previously undocumented remote-access trojan delivered through ClickFix-style lures and installers disguised as Spotify, Zoom Workplace or Microsoft Teams. The malware gives operators command-line access, file control, screenshot capture, payload deployment, remote JavaScript execution and cryptocurrency-wallet discovery. ChainScript consults a Polygon smart contract to locate its active WebSocket command server, allowing operators to redirect infected hosts without changing the implant. The attack requires a victim to execute a malicious Windows installer, which deploys a Node.js runtime and establishes user-level persistence through a scheduled task or Registry Run key.