ChainScript (Azure30) Node.js backdoor: ClickFix msiexec MSI delivery and control panels

ChainScript, also reported as Azure30, is a Node.js backdoor delivered through ClickFix. A fake verification page copies a command to the clipboard and asks the visitor to paste it into the Windows Run box: msiexec, with its /package switch spelled in look-alike Unicode letters and a quiet switch after the URL, silently installs a per-user MSI from the operator's server. The MSI runs its own bundled copy of node.exe on an obfuscated agent, which connects to a WebSocket control panel, reports the computer and any cryptocurrency wallets it finds, and runs scripts the operators send. Builds read their panel address from Polygon smart contracts. This hunt matches scans whose copied command points at the delivery servers, and scans that contacted the delivery or panel hosts.