Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript.
"ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG) researchers Sam Decker, Andi Ursry, and Nevan Beal said.
The real danger is the trust-chain abuse: users initiate execution themselves, while legitimate runtimes make malicious activity resemble normal system behavior.
ChainScript’s blockchain-based C2 resolution also makes infrastructure takedowns and static IOC blocking less effective, pushing defenders toward behavioral detection.