108 malicious ads ran from a verified corporate Reddit account over a 48‑hour period in mid‑September 2026, delivering ClickFix lures that seeded multiple families of malware across macOS and Windows, researchers report.
ChainScript RAT: capabilities, aliases, and delivery
Security researchers in Blackpoint’s Adversary Pursuit Group (APG) identified a previously undocumented remote access trojan (RAT) they call ChainScript. The implant has appeared under multiple build names — ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66 — and has presented itself as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams.
ChainScript is a full‑featured RAT that, once running, gives the operator interactive CMD and PowerShell, file operations, screenshot capture, payload deployment, cryptocurrency wallet enumeration (both desktop apps and browser extensions), and remote JavaScript execution. The malware supports self‑update and removal of persistence, according to Sam Decker, Andi Ursry, and Nevan Beal of Blackpoint APG.
How the Windows ClickFix chain installs ChainScript
The Windows infection chain begins with a ClickFix lure that leads to the download and execution of a malicious Windows installer via msiexec.exe. The example installer observed was named "ComponentTask33-4d14e6ac.msi" and was disguised as Spotify. That MSI deploys the Node.js runtime and launches a ChainScript JavaScript agent through hidden PowerShell and VBScript stages.
The PowerShell stage drops the runtime, agent source, configuration, and auxiliary binaries into Microsoft‑looking paths under %LOCALAPPDATA%, while a VBScript component acts as the main launcher. Once active, the agent establishes user‑level persistence through a scheduled task with a Registry Run key as a fallback and connects to its command‑and‑control (C2) infrastructure over WebSockets to retrieve tasking.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDecentralized C2 discovery: Polygon smart contract and EtherHiding‑style technique
ChainScript uses an EtherHiding‑style discovery technique: the malware queries a Polygon smart contract to discover the active WebSocket infrastructure that serves as its C2. "By separating backend discovery from the malware itself and using the Polygon contract as an external resolver, the operator can redirect infected hosts to new infrastructure while retaining the same implant and reconnect workflow," Blackpoint said.
Blackpoint framed that design as part of an emerging pattern in which malware uses development frameworks and blockchain‑based C2 discovery to enable infrastructure rotation and complicate indicator‑based detection — a deliberate move to resist takedowns and ensure uninterrupted operations.
PasteSwitch and ClickFix: how the lures reached victims
The ClickFix lures were distributed in at least one high‑profile campaign that abused HBO Max’s official Reddit account ("u/hbomax"). Hudson Rock and ADAMnetworks codenamed the activity PasteSwitch. The hijacked, verified account served 108 malicious ads over a 48‑hour period; researchers do not yet know how the account was breached or how many users clicked the ads or were compromised.
On macOS, PasteSwitch delivered MacSync, Atomic macOS Stealer (AMOS), and fake cryptocurrency wallet applications designed to steal recovery phrases. The Windows branch pushed Amatera Stealer and cryptocurrency clippers such as AnimateClipper and ZigClipper. Seqrite Labs reported MacSync infections concentrated in the U.S., followed by the U.K., Germany, Japan, Canada, France, Singapore, Australia, India, and the Netherlands. As Seqrite researcher Chandra Kant Bauri noted, "MacSync campaigns primarily target regions with widespread macOS enterprise use, tech and software development sectors, and active cryptocurrency or Web3 communities."
Codex lure, cloaking techniques, and delivery mechanics
Other ClickFix variants use look‑alike domains and fake download experiences to trick macOS users. Cato Networks described a campaign that surfaced via search results and led users to bogus Google Sites pages that instruct victims to paste a command into Terminal. That command retrieves a shell‑script loader (first stage) containing an embedded blob that is decoded and executed with eval, producing a second‑stage script that records execution and retrieves a final Mach‑O payload.
Microsoft described an evolution in these campaigns: an initial broad use of ClickFix lures gave way to a cluster of at least 250 look‑alike domains and the adoption of a server‑side browser‑fingerprinting gate that displays the lure primarily to visitors whose environment appears consistent with a genuine macOS browser, a cloaking behavior that "limits visibility for crawlers, sandboxes, and some automated analysis workflows."
What this means for security teams, enterprises, and end users
- Security teams and technologists: Expect implants that separate discovery from payloads and that can rotate C2 by updating a blockchain resolver rather than changing in‑malware config; detection that relies solely on static indicators will be easier for operators to evade.
- Enterprises and procurement leaders: Verified, high‑profile accounts can be abused to deliver polished lures at scale — as demonstrated by the HBO Max account incident — so vetting and incident response playbooks for compromised corporate social presences should be a priority.
- End users and administrators: Mac‑focused lures instructing users to paste Terminal commands or to install fake wallets have been a consistent vector; the campaigns also target regions with strong macOS enterprise use and active Web3 communities, reinforcing the need for user education and execution‑control mechanisms.
The technical picture Blackpoint, Microsoft, Hudson Rock, Seqrite Labs, and others paint is starkly practical: operators are pairing social engineering and hijacked distribution channels with malware that can look up and rotate its C2 via a Polygon smart contract. It leaves an open, measurable question the reporting highlights: how many users were exposed or compromised by the 108 malicious ads, and how broadly will operators adopt blockchain‑backed C2 rotation as a standard resilience technique?
