Actor Profile

The Blackpoint Adversary Pursuit Group has identified threat actors leveraging ClickFix-style social engineering lures to distribute ChainScript, a previously undocumented remote access trojan. The actors' motivation appears financially driven, targeting cryptocurrency wallets and deploying information stealers. The campaign demonstrates sophisticated operational security through blockchain-based C2 infrastructure rotation using Polygon smart contracts, complicating attribution and takedown efforts. The actors masquerade malware as legitimate software (Spotify, Zoom Workplace, Microsoft Teams) to establish trust and evade initial user suspicion.

TTPs (Tactics, Techniques, Procedures)

Initial access via ClickFix social engineering lures leading to malicious MSI installer execution through msiexec.exe (T1204.002 - User Execution: Malicious File). Deploys Node.js runtime with hidden PowerShell (T1059.001) and VBScript (T1059.005) stages. Establishes persistence via scheduled tasks (T1053.005) with Registry Run key fallback (T1547.001). Uses EtherHiding-style C2 discovery through Polygon blockchain smart contracts for infrastructure rotation (T1102 - Web Service). Capabilities include command execution via CMD and PowerShell, file operations (T1005 - Data from Local System), screen capture (T1113), credential access targeting cryptocurrency wallets (T1555 - Credentials from Password Stores), and remote JavaScript execution. Supports self-update and persistence removal functions.

Targets & Patterns

The campaign demonstrates broad targeting without specific sector focus, though the cryptocurrency wallet enumeration capability (both desktop applications and browser extensions) suggests financial motivation targeting crypto asset holders. The masquerading as popular enterprise collaboration tools (Zoom Workplace, Microsoft Teams) and consumer applications (Spotify) indicates targeting of both corporate and individual users. Related PasteSwitch activity concentrated in regions with widespread macOS enterprise use, tech/software development sectors, and active cryptocurrency/Web3 communities, particularly the U.S., U.K., Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands. The use of compromised verified accounts (HBO Max Reddit) and polished social engineering assets indicates targeting of users who may apply heightened scrutiny to typical phishing attempts.

Historical Context

ChainScript represents an evolution in blockchain-based C2 infrastructure, building on the EtherHiding technique observed in recent malware families. The campaign is part of a broader ClickFix attack pattern that has expanded significantly in 2026. Microsoft reported observing macOS ClickFix campaigns in August 2026 using at least 250 look-alike domains to distribute MacSync and Atomic Stealer, with evolution from broad lure distribution to server-side browser fingerprinting gates for cloaking. The PasteSwitch campaign in mid-September 2026 demonstrated threat actor willingness to compromise high-profile verified accounts, with the HBO Max Reddit account serving 108 malicious ads over 48 hours. ClickFix techniques have been observed delivering multiple malware families including Amatera Stealer, AnimateClipper, ZigClipper, MacSync, and Atomic macOS Stealer across Windows and macOS platforms, indicating a shared TTP adopted by multiple threat actors or a malware-as-a-service model.

Defensive Recommendations

  • Monitor msiexec.exe execution with unusual parent processes or command-line parameters, particularly those downloading installers from non-standard sources (T1218.007)
  • Detect Node.js runtime deployments in user-writable directories (%LOCALAPPDATA%) combined with hidden PowerShell (T1059.001) and VBScript (T1059.005) execution via process monitoring
  • Implement network monitoring for WebSocket connections to unusual or newly registered domains, and blockchain API queries to Polygon smart contract endpoints indicative of C2 discovery
  • Hunt for scheduled tasks (T1053.005) and Registry Run keys (T1547.001) created by scripting interpreters pointing to Microsoft-themed paths in user directories
  • Deploy user awareness training specifically addressing ClickFix social engineering tactics that instruct users to paste commands into Terminal or PowerShell, emphasizing verification of software download sources