Loading story…
A new cybercrime tool called ErrTraffic has emerged, enabling attackers to automate ClickFix attacks by injecting fake browser glitches into compromised websites. This tool leverages a single line of JavaScript code to display convincing visual errors, such as broken text and corrupted fonts, which are tailored to the victim's device and language. The psychological manipulation prompts users to take corrective action, such as downloading malicious payloads or running harmful commands, under the guise of fixing browser or system issues.
ErrTraffic is being sold on underground forums for approximately $800, making it accessible to less skilled cybercriminals and facilitating attacks across multiple platforms, including Windows, Android, macOS, and Linux. The tool's professional design and automation features allow for large-scale deployment, raising concerns about increased supply chain and social engineering risks for organizations using platforms like WordPress, Joomla, and cPanel. Security researchers have highlighted the need for heightened vigilance and defensive strategies to counter this evolving threat.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on research described a broader self-sustaining cycle in which infostealer malware steals administrative credentials that attackers then use to hijack legitimate business websites for malware hosting and further ClickFix delivery. Hudson Rock and the ClickFix Hunter platform reported tracking more than 1,600 domains involved in these campaigns, showing how compromised legitimate infrastructure helps the activity persist and scale.
Security researchers, including Hudson Rock, documented ErrTraffic as a professionally designed cybercrime tool that injects JavaScript into compromised websites to display fake error messages and trick users into running malicious commands. Their analysis highlighted high reported conversion rates, selective targeting, and use of stolen CMS credentials to spread to additional WordPress, Joomla, and cPanel-managed sites.
A threat actor using the name LenAl began selling ErrTraffic, a self-hosted traffic distribution system that automates ClickFix attacks, for about $800 on Russian-language forums. The tool supports tailored lures and payload delivery across Windows, macOS, Linux, and Android while avoiding users in Russia and nearby CIS countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcerescana.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **ErrTraffic**, a growing malware-as-a-service framework that injects JavaScript into compromised WordPress sites to present **ClickFix** lures and deliver malware. The operation uses **EtherHiding** on the Polygon blockchain to conceal and rotate command-and-control infrastructure, and investigators identified two clusters—**Analytics** and **Beer**—with different smart-contract usage, C2 methods, JavaScript implementations, and payload delivery patterns. The **Beer** cluster is assessed as the active rental service used by multiple affiliates, while **Analytics** appears tied to a single operator using acquired source code. Campaigns linked to ErrTraffic used stolen WordPress administrator credentials, PHP backdoors, malicious MU-plugins, and fake AI-themed sites impersonating **Google Antigravity** and **ChatGPT** to distribute malware including **Vidar**, **Stealc**, **DanaBot**, **HijackLoader**, **Remus**, **Salat**, and **SmokeLoader**. Separate reporting also exposed a live malware distribution backend after a researcher found an unsecured PHP installer at `/install/install.php`, allowing administrative access to the panel that managed hosted payloads, dynamic download pages, and multi-stage redirection chains; although the operators patched that weakness, the infrastructure reportedly remains active. Defenders were provided with domains, delivery URLs, and file hashes to support detection and response.
Jul 12, 2026
Security researchers report that **ClickFix** has become a major initial-access technique, relying on social engineering rather than software exploits to trick users into pasting attacker-provided commands into **Windows Run** or **macOS Terminal**. ESET said detections rose **108%** from H2 2025 to H1 2026, while RH-ISAC described a broader **517%** increase from late 2024 into the first half of 2025 and noted that Microsoft saw the method in **47%** of initial-access cases handled by Defender Experts. Attackers have expanded ClickFix beyond Windows to **macOS**, delivered it through compromised **WordPress** sites, and improved lures with fake **BSOD** screens, frozen document viewers, and service-specific error messages. The technique is now used by both cybercriminals and state-backed groups, with RH-ISAC linking adoption to **Sandworm, APT28, MuddyWater, and Kimsuky** and citing Sandworm activity against organizations in Ukraine, including at least one compromise involving **FreakyPoll** malware. Researchers also observed ClickFix delivering malware such as **ACR Stealer, OkoBot, TELEPUZ, ClickLock Stealer**, and **DriveSurge**, while newer variants including **CrashFix, FileFix, PromptFix, and ConsentFix** show continued evolution. ESET additionally identified an **"AI-fix"** variant that abuses legitimate domains tied to **Anthropic Artifact**, **OpenAI Canvas**, and **Microsoft Copilot Pages** to display fake troubleshooting content for nonexistent AI problems, underscoring how attackers are blending trusted platforms, AI branding, and increasingly industrialized delivery infrastructure.
Jul 20, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026