Threat Hunter: 2026-09-21

1. ChainScript: Tracing a Node.js RAT Through the Blockchain

   Blackpoint Cyber, 2026-09-18. Read, 17 min.

   Blackpoint's Adversary Pursuit Group named ChainScript, a Node.js remote access trojan it found while investigating ClickFix activity that ended in a malicious Windows Installer disguised as Spotify software. The installer deploys its own Node.js runtime and launches a JavaScript agent through hidden PowerShell and VBScript stages, and the agent has appeared under build names including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66 while presenting itself as Spotify, Zoom Workplace and Microsoft Teams software.

   Why it matters for this role: Hunt for a bundled Node.js runtime launched by an installer presenting itself as Spotify, Zoom Workplace or Microsoft Teams software, and for the build names Blackpoint lists, including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66. The blockchain lookup gives you a second thing to hunt for that does not depend on the current infrastructure.

Threat Hunter