Plan
active
ChainScript RAT Uses Polygon Blockchain for C2 Rotation via ClickFix Lures
- Engineer — Learn: Using a public blockchain (Polygon) for C2 infrastructure rotation is a novel evasion technique worth understanding for future detection architecture; no running system needs patching, but this reinforces restricting outbound RPC calls from endpoints to blockchain nodes.
- SOC/IR — Plan: Build or tune detections for ClickFix-style user-execution lures impersonating Teams/Zoom/Spotify, and add hunting logic for endpoints making Polygon RPC calls; no specific IOCs are published yet, so schedule this as a detection engineering task rather than an immediate sweep.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.