A fake Spotify installer that hides its instructions on a blockchain
Installers are a soft target. Nobody inspects one. You wanted Spotify, a file called Spotify turned up, you double-clicked it, and Windows put up the usual box asking if you were sure.
Blackpoint's Adversary Pursuit Group published an analysis on 18 September of a remote access tool they have named ChainScript, found while they were pulling apart a ClickFix campaign. The chain starts with one of those pages that tells you to copy something and run it, and ends with a Windows installer launched through msiexec.exe. Four builds have turned up so far. Two of them, ComponentTask33 and UpdateDigital, present themselves as Spotify; HostShared poses as Zoom Workplace and OrchidViolet66 as Microsoft Teams. The installer quietly drops a Node.js runtime and starts a JavaScript agent behind hidden PowerShell and VBScript stages.
From there the operator gets a command prompt and a PowerShell session on your machine, can read and write and delete files, take screenshots of your desktop, push new payloads, and run whatever JavaScript they like inside the agent. It also goes looking for cryptocurrency wallets, both installed apps and browser extensions. The part researchers find most interesting is where it gets its orders: rather than a hardcoded address, ChainScript queries a smart contract on the Polygon blockchain to find the server it should connect to. Blocking one domain achieves nothing, because the operators can point the contract somewhere else and every infected machine follows.
The fix for all of this sits at the very first step. A web page that wants you to paste a command into the Run box or a terminal to prove you are human, fix your video or finish an update is lying, every time, without exception. And free software should come from the company that makes it or the Microsoft Store, not from whichever result the search engine put at the top. Tendvane's app-update check goes through winget, so Spotify, Zoom and the rest get pulled from their official packages instead of something you found.