ErrTraffic

ErrTraffic is a malware-as-a-service traffic distribution system and malicious JavaScript framework used to automate ClickFix social-engineering campaigns. It is injected into compromised websites, particularly WordPress sites, where it selectively presents fake browser errors, CAPTCHA or verification pages, and system-error lures based on visitor attributes such as operating system, language, geography, and referrer. The lures commonly instruct victims to paste and execute a clipboard-populated command, frequently through PowerShell on Windows, to retrieve attacker-selected payloads.

ErrTraffic uses EtherHiding-style dead-drop resolution through Polygon smart contracts to obtain and rotate its active backend infrastructure without modifying JavaScript already implanted on compromised sites. Recent variants use JavaScript obfuscation and encrypted panel communications, provide campaign telemetry and payload-delivery functions, and support lure templates for Windows and macOS. The framework has distributed diverse follow-on malware, including information stealers, loaders, remote-access tools, and banking malware.

ErrTraffic has been advertised on Russian-language cybercrime forums and Telegram by an actor using the name LenAI since late 2025. Research distinguishes an active affiliate-oriented Beer cluster from an Analytics cluster likely operated independently with an earlier ErrTraffic codebase. Some associated WordPress compromises use credential-harvesting backdoors, webshell functionality, and persistent malicious plugins to retain control of websites and expand the delivery infrastructure. ErrTraffic targets or supports Windows, macOS, Android, and Linux payload delivery; the observed ClickFix execution chains most prominently affect Windows users.