ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

Report facts: The article describes threat actors using ClickFix-style lures to distribute a new remote access trojan (RAT) named ChainScript, which masquerades under multiple build names and impersonates popular software like Spotify, Zoom Workplace, and Microsoft Teams. It also notes the use of Polygon-based infrastructure rotation for command-and-control, complicating takedown and tracking. RealGround analysis: While the campaign targets traditional endpoints rather than AI systems directly, similar techniques—fake productivity apps and rapidly rotating infrastructure—could be used to infiltrate environments where AI agents operate or compromise the software supply chain feeding AI tools. Organizations should harden download and update channels, monitor for anomalous binaries and rotating C2 patterns, and integrate continuous red teaming and SBOM-based supply chain review to detect malware that might later be leveraged to manipulate or surveil AI systems.