TL;DR: ChainScript traces a Node.js RAT that uses malicious installers, hidden launch stages, and a Polygon-based resolver to rotate WebSocket command infrastructure while keeping the agent consistent, according to Blackpoint Cyber’s analysis. The pattern shows why indicator-led detection fails when malware separates payload behaviour from its backend control plane.
At a glance
What this is: Blackpoint Cyber’s ChainScript analysis details a Node.js remote access trojan that hides behind fake software installers and uses blockchain-based C2 discovery to keep rotating its backend.
Why it matters: This matters because defenders need to detect the agent, persistence, and resolver pattern, not just block one domain or hash, when malware can change infrastructure without changing behaviour.
By the numbers:
- The analyzed build targeted contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 on chain ID 137.
Context
ChainScript is a Node.js remote access trojan, or RAT, that uses a fake software installer and layered launchers to reach execution on a Windows endpoint. The primary security problem is not just one malicious file, but the way the malware separates delivery, persistence, runtime, and command infrastructure so defenders have to correlate multiple weak signals.
For IAM and NHI teams, the identity angle is indirect but real: malware like this abuses host context, user-level persistence, and authentication to its C2 channel rather than a human login flow. That means conventional perimeter blocking and hash-based response can miss the control plane that matters most.
The article’s evidence points to a pattern now common in commodity and semi-custom malware, where infrastructure is rotated independently from the payload. That makes process lineage, launcher artifacts, and network-behaviour correlation more useful than single indicators in isolation.
Key questions
Q: What failure mode does a blockchain-based C2 resolver create for defenders?
A: It breaks the assumption that command infrastructure is fixed long enough to block or sinkhole reliably. When the implant resolves its panel dynamically from an on-chain record, defenders must detect the resolver behaviour and not just the current domain or IP.
Q: Why do user-level scheduled tasks and Run keys matter in RAT investigations?
A: They let the malware persist without administrator rights and without creating noisy system-wide changes. That means incident responders need to inspect user-context autoruns, script launchers, and profile paths rather than relying on service-based persistence checks.
Q: What do security teams get wrong about malware that uses fake software installers?
A: They often focus on the file name or lure rather than the execution chain. In practice, the installer, hidden scripts, and child processes are the signal, because those layers reveal the malware even when the visible branding looks legitimate.
Q: What should teams do after a Node.js RAT is discovered on an endpoint?
A: Treat the event as a full remote-access compromise, isolate the host, review for payload staging and secondary activity, and rotate any credentials exposed through the affected system. The malware’s command set can support follow-on intrusion, not just local disruption.
Technical breakdown
ClickFix delivery and disguised MSI execution
ChainScript begins with ClickFix activity that leads the user to run msiexec.exe and install a malicious MSI disguised as common software. The installer drops a Node.js runtime, launcher scripts, and the JavaScript agent, then uses hidden PowerShell and VBScript stages to start execution without a visible console. Running in user context with MSIINSTALLPERUSER=1 and ALLUSERS=2 reduces friction and helps the infection continue without administrator privileges. The result is a multi-stage delivery chain that looks like routine software installation unless defenders inspect process lineage and file placement.
Practical implication: detections should correlate installer provenance, script launchers, and child process behaviour rather than trusting the apparent application name.
User-level persistence through scheduled tasks and Run keys
The malware establishes persistence entirely in the user profile, first trying to create a hidden scheduled task and then falling back to HKCU Run if task creation fails. That design keeps the implant alive without system-wide changes and makes it harder to spot during coarse-grained hygiene checks. ChainScript also uses Microsoft-themed directories and separate staging paths to break the obvious relationship between the launcher, runtime, configuration, and helper tools. In practice, this is a persistence model built for blending in, not for speed or elegance.
Practical implication: hunt for user-context persistence objects, not just service installs, and baseline unusual scheduled tasks that point to script launchers.
Blockchain-based C2 discovery and rotating WebSocket panels
ChainScript uses an EtherHiding-style resolver pattern in which a Polygon smart contract returns the active WebSocket panel at runtime. The agent queries the contract with eth_call, decodes the response, validates the WebSocket scheme, caches the result briefly, and then authenticates over the panel with an X-Agent-Token header. Because the panel address is resolved dynamically, the operator can rotate backend infrastructure without rebuilding the implant. That separates payload behaviour from infrastructure management and weakens simple IOC-based blocking.
Practical implication: monitor unexpected blockchain RPC access followed by WebSocket registration, and treat resolver behaviour as a control plane indicator.
Threat narrative
Attacker objective: The objective is persistent interactive control of the infected Windows host with the ability to task, update, and extend the implant while rotating C2 infrastructure.
- Entry occurs when ClickFix activity leads the user to execute a malicious MSI that impersonates familiar software.
- Credential or session-like access is established when the agent authenticates to its panel using an X-Agent-Token and host-derived identity values.
- Escalation and persistence follow through user-level scheduled tasks, Run-key fallback, and staged launchers that keep the agent resident.
- Impact is broad remote system control, including shell access, file operations, screenshots, payload deployment, wallet discovery, and remote JavaScript execution.
Breaches seen in the wild
- Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
- CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Infrastructure rotation is now part of the malware design, not a post-compromise convenience. ChainScript separates the agent from its backend resolver so the operator can rotate WebSocket infrastructure without changing the core payload. That means defenders who focus only on domains, hashes, or one panel address are already behind the attacker’s operational model. Practitioners should elevate behavioural correlation and resolver tracing over single-point IOC blocking.
ChainScript shows why user-context persistence remains a high-value blind spot. The malware avoids privileged service installation and instead leans on scheduled tasks, Run keys, and script launchers inside the user profile. That pattern is especially hard to distinguish from ordinary endpoint noise when organisations do not baseline user-level autorun objects. Security teams should treat user-context persistence as a primary hunting surface, not a secondary cleanup detail.
Blockchain-based resolver logic creates a control-plane trust gap. The malware’s use of a Polygon contract to locate its active panel means the malicious infrastructure can move without altering the implant’s visible shape. This is not just an evasion trick; it is a governance problem for detections that assume the address space of the threat is static. Defender workflows need to account for resolver behaviour, not only endpoint artefacts.
Remote access trojans now behave like modular access platforms. ChainScript bundles shell access, file transfer, screenshots, payload staging, wallet discovery, and remote JavaScript execution into one operator workflow. That makes compromise a broader access event than a simple malware infection, with downstream risk to credentials, wallets, and secondary payload deployment. Practitioners should classify this class of incident as a full remote-access compromise and respond accordingly.
What this signals
ChainScript is a useful reminder that modern malware governance is partly an identity problem. The payload runs in user context, persists through user-level autoruns, and authenticates to remote infrastructure with its own token and host identity. That combination means endpoint teams and identity teams need a shared view of what the host is allowed to do and what it is allowed to reach.
Resolver-driven malware shifts the defender’s focus from destination to mechanism. If the C2 endpoint is discovered at runtime, blocking a static IP list only addresses the symptom. The programme-level control is to detect the resolver pattern, the staging artefacts, and the first outbound session that proves the payload has operational control.
ChainScript also shows why threat hunting must join process telemetry with network telemetry. A Node.js runtime, VBScript launch chain, and WebSocket registration look weak on their own, but together they form a reliable detection story. Teams should build hunts around those sequences instead of waiting for a known hash to surface.
For practitioners
- Hunt for staged launch artefacts Prioritise ._agent.vbs, app\src\index.js, connect-delay-state.json, and bundled Node.js runtimes under %LOCALAPPDATA% or %APPDATA%. These artifacts stayed consistent across the observed builds and are more durable than a domain block.
- Baseline user-context persistence objects Review hidden scheduled tasks and HKCU Run entries that point to wscript.exe or other script launchers. ChainScript uses user-level persistence specifically to avoid elevation, so the control surface is endpoint autoruns rather than services.
- Correlate blockchain lookups with WebSocket registration Alert when endpoints make unexpected Polygon or EVM RPC requests and then open outbound WebSocket connections. The pairing is more actionable than either behaviour alone because it reveals resolver-driven C2 discovery.
- Treat disguised installers as remote access precursors Investigate MSI packages that impersonate common software names and launch hidden PowerShell or VBScript stages. In this campaign, the installer was the delivery vehicle for the full RAT chain, not a simple dropper.
- Escalate response to a full remote-access compromise Isolate affected endpoints, review for secondary payloads and downstream activity, and rotate exposed credentials where the host may have been used for access or staging. ChainScript’s shell, file, screenshot, and deployment functions make containment the first priority.
Key takeaways
- ChainScript combines a fake software installer, hidden launch stages, and user-level persistence to deliver a Node.js RAT that is designed to blend into ordinary endpoint activity.
- The malware’s Polygon-based resolver lets operators rotate WebSocket C2 infrastructure without changing the underlying agent, which weakens indicator-only detection.
- Defenders should treat the campaign as a full remote-access compromise and prioritise process lineage, resolver behaviour, and user-context persistence in hunts and response.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0003; TA0006; TA0011 — Initial Access; Persistence; Credential Access; Command and Control | ChainScript uses staged delivery, persistence, tokenised C2, and interactive control. |
| Recommendation — Map the observed chain to these ATT&CK tactics and tune detections for launch, persistence, and C2 behaviour. | ||
| CIS Controls v8 | CIS-5 — Account Management | User-level persistence and host identity handling make account lifecycle and autoruns relevant. |
| Recommendation — Review account and autorun governance to remove user-context persistence paths abused by the RAT. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | The article centres on correlating process, network, and resolver activity for detection. |
| Recommendation — Instrument network and endpoint telemetry so resolver-driven C2 activity is visible early. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | The malware authenticates to its remote panel with a token and host identity values. |
| AC-6 — Least Privilege | The implant persists and operates entirely in user context to avoid privilege escalation. | |
| Recommendation — Apply IA-9 to detect and restrict non-organizational systems authenticating to remote services. Enforce least privilege so user-context malware cannot gain unnecessary execution paths. | ||
Key terms
- Remote Access Trojan: A remote access trojan is malware that gives an attacker interactive control over a compromised system after execution. It usually combines a loader, persistence and a command channel so the attacker can issue instructions, exfiltrate data or deploy additional payloads without repeatedly exploiting the target.
- Blockchain-based C2 Discovery: Blockchain-based C2 discovery is a control-plane technique where malware retrieves its active command server from an on-chain record or smart contract. It complicates takedown and filtering because the resolver path is dynamic, public, and separable from the payload itself.
- User-Level Persistence: User-level persistence is malware retention that lives under a normal user context rather than requiring administrator rights. It often uses scheduled services or startup hooks in user-owned paths, which makes it harder to spot during routine system checks and easier to survive reboots.
- Resolver-driven Command Infrastructure: Resolver-driven command infrastructure means the malware does not hardcode a stable command server and instead asks a separate mechanism where to connect. This creates a moving target for defenders and shifts detection toward the resolver, not just the final domain or IP.
Deepen your knowledge
The NHI Foundation Level course covers NHI governance, machine identity security, and secrets management through the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity controls to broader security operations and response.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org