Loading threat actor…
LenAI is a cybercriminal operator and malware-as-a-service vendor active on Russian-language underground forums and Telegram since at least December 2025. LenAI advertises and sells ErrTraffic, a traffic-distribution and ClickFix framework used to inject malicious JavaScript into compromised WordPress sites. ErrTraffic presents fake verification or error prompts that induce victims to execute clipboard-delivered PowerShell commands, facilitating downstream malware delivery. Its features include social-engineering templates, operating-system detection, geographic and referrer filtering, payload delivery, execution statistics, JavaScript and AES obfuscation, and blockchain-based dead-drop resolution of command-and-control infrastructure through Polygon smart contracts. LenAI is assessed to operate the ErrTraffic "Beer" cluster and rent it to affiliates, whose campaigns have delivered information stealers, loaders, remote-access tools, and other malware. LenAI also advertised Aeternum C2, a native loader whose operators use Polygon smart contracts and public RPC endpoints for resilient command-and-control, with virtualization checks and antivirus-evasion-oriented build scanning. LenAI's activity is financially motivated through subscriptions, source-code sales, and malware-toolkit sales.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
87 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.