ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Threat actors are using lures similar to ClickFix to deploy a newly discovered remote access trojan called ChainScript. ChainScript has been identified under various build names, including ComponentTask33 and OrchidViolet66. This malware disguises itself as legitimate software, such as Spotify, Zoom Workplace, and Microsoft Teams. The ChainScript RAT is being used to rotate command and control infrastructure using Polygon.