ChainScript: Tracing a Node.js RAT Through the Blockchain

Reported 18 Sep 2026 by otx · Severity: medium

Blackpoint's Adversary Pursuit Group identified ChainScript, a previously unnamed Node.js remote access trojan discovered during ClickFix investigation. The malware disguises itself as legitimate software including Spotify, Zoom Workplace, and Microsoft Teams through malicious Wi