ErrTraffic

ErrTraffic is a malware-as-a-service traffic distribution system and JavaScript-based delivery framework designed to operationalize ClickFix social-engineering campaigns. It is marketed by the threat actor LenAI and is commonly deployed through JavaScript injected into compromised WordPress websites. The framework presents device- and language-tailored fake verification or error interfaces, including CAPTCHA, browser-verification, and system-error themes, to induce visitors to copy and execute attacker-supplied commands, commonly through PowerShell or the Windows Run dialog. ErrTraffic supports delivery of operator-selected payloads, including information stealers, loaders, remote-access malware, and Android banking trojans.

ErrTraffic incorporates geolocation, operating-system, browser, and referrer filtering; visitor telemetry; campaign statistics; and configurable lure templates. Its infrastructure uses EtherHiding, querying Polygon smart contracts through public RPC services to resolve and rotate panel or command-and-control infrastructure without updating the JavaScript deployed on compromised sites. Implementations use JavaScript obfuscation and encrypted backend communications to hinder analysis and infrastructure tracking.

Observed ErrTraffic activity includes malicious WordPress plugins and PHP backdoors that provide persistent access to compromised websites, collect administrator credentials, inject malicious client-side scripts, and in some cases support webshell and payment-skimming functions. Documented campaigns have targeted Windows users and have also provided payload workflows for macOS, Android, and Linux. ErrTraffic has been used as the delivery component in modular MaaS operations, including campaigns attempting to deploy Cruciferra and ultimately the Remus information stealer.