New ChainScript spyware hides its command server in a blockchain

Blackpoint identified ChainScript, a previously undocumented Node.js remote access trojan that uses a Polygon smart contract to discover and rotate its command-server address. The malware was observed in a ClickFix campaign and distributed under the guise of Spotify, Zoom Workplace, and Microsoft Teams.