ClickFix Lures Deploy ChainScript RAT: How Attackers Use Polygon to Dodge Detection

Cybersecurity researchers have uncovered a sneaky new campaign that combines the now-infamous ClickFix phishing trick with a freshly minted remote access trojan (RAT) named ChainScript. What makes this malware particularly slippery is its use of the Polygon blockchain network to rotate command-and-control (C2) infrastructure in real time, effectively making static blocklists and IP-based defenses obsolete. This blog post dives into the attack chain, explains the blockchain-based evasion technique, and offers practical recommendations for defenders looking to stay ahead of this evolving threat.

If you've been following phishing trends, you've likely encountered ClickFix — a social engineering ploy that disguises malicious instructions as a fake CAPTCHA or bot check. The user is prompted to copy a command into the Windows Run dialog or PowerShell terminal to "verify they're human." Instead, that command downloads and executes a payload. Attackers have been using ClickFix for months to deliver infostealers like Lumma and RedLine, but the latest twist involves a custom RAT and an innovative C2 rotation scheme that leverages the Polygon cryptocurrency network.

The chain starts with a compromised or malicious website serving a convincing "Please press Ctrl+V to verify" overlay. Once the user follows the instruction, a multi-stage PowerShell script is executed. That script reaches out to a blockchain explorer API (typically PolygonScan) and pulls a string of data from a specific smart contract or transaction. That data contains the actual C2 server address—or more precisely, a list of addresses that the malware rotates through. If one C2 gets blocked or taken down, the attacker simply publishes a new transaction on Polygon, and all infected machines automatically pull the updated address on their next check-in.

This technique isn't entirely new—cybercriminals have experimented with blockchain-based C2 for years, often using Bitcoin or Ethereum to store DNS seeds or IPs. But Polygon offers several advantages: it's fast, has negligible transaction fees, and is commonly used for DeFi apps, making its traffic look innocent. Moreover, the data stored in a transaction can be obfuscated or encrypted, making it a challenge for security tools to parse. The use of a public, immutable ledger means that attackers don't need to maintain their own domain infrastructure, which can be seized or sinkholed. Instead, they just push new data to the chain—the ultimate in decentralized resilience.

Now, let's talk about the payload itself. ChainScript RAT is a lightweight, script-based remote access trojan. It can be written in PowerShell or JScript, making it difficult to detect by signature-based antivirus since it resides entirely in memory or uses reflective loading techniques. Once installed, it provides the attacker with comprehensive control: keylogging, screen capture, file exfiltration, and the ability to execute additional payloads. Most concerning, it can act as a loader for ransomware or other dangerous implants, giving hackers a foot in the door to escalate privileges across the network.

The ClickFix lure is particularly effective because it abuses user trust in familiar browser interactions. Even security-conscious users may not realize that pressing Ctrl+V can execute a malicious command—especially when the fake CAPTCHA looks exactly like a legitimate one. The attackers also employ obfuscation: the pasted command is often encoded or split across multiple lines to evade simple pattern matching. In the wild, we've seen these lures embedded in YouTube video descriptions, on fake job boards, and even inside Discord messages. This new campaign appears to be targeting cryptocurrency enthusiasts and remote workers, likely due to their higher financial value and reliance on browser-based tools.

From a defensive perspective, the use of Polygon for C2 rotation introduces significant headaches. Traditional network monitoring that relies on IP allowlists, sinkholing, or domain reputation will fail because the C2 addresses are ephemeral and dynamically updated. Even if a security team identifies one C2 IP and blocks it, the malware simply fetches a new address from the blockchain. Worse, the C2 traffic is often encrypted over standard HTTPS, blending in with normal web traffic. This is a classic example of attackers using legitimate infrastructure to hide in plain sight.

So, what can organizations do to defend against this sophisticated attack? First and foremost, endpoint detection and response (EDR) tools that monitor for suspicious PowerShell execution and script behavior are essential. The initial ClickFix command can be blocked by enforcing a strict application allowlist policy—for example, disabling the ability to run PowerShell from Internet-facing processes. Additionally, educating employees about ClickFix scams is critical. Users should never copy and paste commands into terminals or the Run dialog unless they are absolutely certain of the source. A simple rule of thumb: legitimate CAPTCHAs never ask you to run a terminal command.

On the network side, defenders should implement robust egress filtering and consider using a secure web gateway that can identify and block attempts to interact with blockchain APIs, at least for non-essential workstations. More advanced approaches involve using threat intelligence feeds that track known Polygon smart contracts used for C2—researchers have already started cataloging these. However, since the contracts can be generated rapidly and at minimal cost, this is an uphill battle. Ultimately, a zero-trust architecture that minimizes lateral movement will limit the damage even if a single workstation is compromised.

The discovery of ChainScript RAT using Polygon for C2 rotation underscores a broader trend in cybercrime: the professionalization of evasion techniques. As defenders get better at blacklisting known infrastructure, attackers are turning to decentralized networks, legitimate cloud services, and anonymization tools to keep their operations alive. This particular campaign also highlights the growing intersection between cryptocurrency ecosystems and malware development—not just for ransom payments, but for operational resilience. It's a reminder that cybersecurity is no longer just about patching software; it's about understanding how attackers exploit the trust we place in everyday digital technologies.

In conclusion, the ClickFix method, combined with the ChainScript RAT and Polygon-based C2 rotation, represents a new watermark in stealthy malware delivery. While the attack chain is complex, the underlying principles are familiar: social engineering to get the user to run code, modular malware to maintain control, and redundant infrastructure to survive takedowns. For security researchers and IT teams, the key takeaway is the need for proactive threat hunting based on behavior, not just signatures. Watch for unusual PowerShell invocations, suspicious blockchain API calls, and unexpected outbound connections. And always—always—train users to think twice before they press Ctrl+V.