Loading malware…
ErrTraffic is a JavaScript-based malware-delivery framework and ClickFix toolkit sold as malware-as-a-service by the cybercriminal actor LenAI since at least December 2025. It combines traffic distribution, payload management, social-engineering templates, operating-system detection, geographic and referrer filtering, and campaign statistics. It supports delivery targeting Windows, macOS, and Linux, with extensively documented Windows infection chains.
ErrTraffic is primarily injected into compromised WordPress websites, where it displays counterfeit Cloudflare Turnstile checks, Google reCAPTCHA challenges, or blue-screen error messages. Its lures place malicious commands on visitors’ clipboards and instruct them to paste and execute those commands. Windows campaigns commonly use PowerShell to retrieve subsequent payloads. ErrTraffic has also been deployed on attacker-controlled websites impersonating popular software and AI services.
The framework uses EtherHiding: injected scripts query Polygon blockchain smart contracts to resolve current command-and-control infrastructure. This dead-drop resolver allows operators to rotate backend domains without updating every compromised website. Observed implementations use JavaScript obfuscation, Base64 encoding, XOR encryption, and encrypted backend communications.
ErrTraffic serves multiple criminal operators and distributes diverse payloads, including Vidar, Stealc, Remus, SmokeLoader, and Cruciferra, as well as remote-access malware. Credential theft, process injection, and security-tool termination in these infection chains are functions of downstream payloads rather than inherent ErrTraffic capabilities. The competing Exvicy framework substantially reuses ErrTraffic’s injected scripts and lure-page code.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
WatchGuard telemetry identified a campaign associated with the use of ErrTraffic, a Malware-as-a-Service (MaaS) framework, to distribute malware through ClickFix ... embedded in compromised WordPress websites.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
ClickFix social engineering lures embedded in compromised WordPress websites... Analysis revealed multiple operational clusters, malicious WordPress plugins...
Victims first land on a hacked WordPress site. An obfuscated ErrTraffic script sits inside the page.
Le leurre ClickFix copie une commande PowerShell malveillante dans le presse-papiers et incite la victime à l’exécuter via Windows Key + X -> I.
The attack begins on a legitimate WordPress site that attackers have already compromised. An obfuscated JavaScript injection contacts attacker-controlled infrastructure, retrieves the lure, and presents a verification page that looks routine.
Subsequent PowerShell stages use a legitimate Microsoft-signed program to side-load Cruciferra as mscoree.dll.
Attackers trick users into running PowerShell... The PowerShell command kicks off several stages.
var decoded = _0xe89dd1(_0xaaa71f, _0xb0c5b4); (new Function(decoded))();
The lure copies a hidden PowerShell command to the clipboard. It then tells the user to open PowerShell and paste it. This social trick is called ClickFix.
The lure copied a malicious PowerShell command to the victim's clipboard and instructed them to paste and run it.
Victims are told to press Win+R, paste and press Enter, running a PowerShell command already copied to their clipboard.
The framework incorporates a Traffic Distribution System (TDS)...
ErrTraffic primarily targets WordPress websites by deploying a PHP backdoor script in the must-use plugin (mu-plugin) that captures administrator credentials and ensures persistence on compromised sites.
T1543 — Create or Modify System Process (Persistence)
T1543 — Create or Modify System Process (Persistence)
Injection JavaScript dans des sites WordPress compromis (obfusqué via Base64 + XOR).
The cloudflare entry is the Windows ClickFix presentation module... [it] renders a fake Cloudflare verification page inside a closed Shadow DOM.
The framework incorporates a Traffic Distribution System (TDS)...
The lure pages share the same clipboard, fingerprinting, anti-analysis and polling functions.
The use of multilingual content and environment-aware targeting further strengthens these lures by adapting the message based on the visitor’s browser language, operating system, and environment
the team found that ErrTraffic primarily targets WordPress websites by deploying a PHP backdoor script in the must-use plugin (mu-plugin) that captures administrator credentials
The lure pages share the same clipboard, fingerprinting, anti-analysis and polling functions.
The use of multilingual content and environment-aware targeting further strengthens these lures by adapting the message based on the visitor’s browser language, operating system, and environment
Victims are told to press Win+R, paste and press Enter, running a PowerShell command already copied to their clipboard.
ErrTraffic also uses Polygon blockchain smart contracts to locate its current command server. That design lets operators rotate infrastructure without rewriting the code planted across compromised sites.
Logique de communication C2 (dl, check) quasi-identique ... Domaines C2 : cloudflare-check[.]net, recaptcha-check[.]com.
Résout son domaine C2 via un smart contract Polygon (méthode getDomain , RPC eth_call )
“ErrTraffic's use of the Polygon blockchain for C2 addresses.”
An obfuscated JavaScript injection contacts attacker-controlled infrastructure, retrieves the lure, and presents a verification page that looks routine.
The framework incorporates a Traffic Distribution System (TDS)...
This script utilizes the Ethereum blockchain to resolve command-and-control (C2) addresses
It concatenates the static API key and nonce to derive the RC4 key, encrypts the query string... The generic loader supports... RC4... [and] AES-GCM support for authenticated payload decryption.
138 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.