command-and-control-methodloader-delivery-mechanismcybercrime-service-ecosystemcredential-stealer-activity

ErrTraffic ClickFix Framework Uses WordPress and Blockchain-Hidden C2 to Spread Malware

Attack Tradecraft · 4 sources · Updated 4mo ago · First seen Jun 17, 2026

Researchers detailed ErrTraffic, a growing malware-as-a-service framework that injects JavaScript into compromised WordPress sites to present ClickFix lures and deliver malware. The operation uses EtherHiding on the Polygon blockchain to conceal and rotate command-and-control infrastructure, and investigators identified two clusters—Analytics and Beer—with different smart-contract usage, C2 methods, JavaScript implementations, and payload delivery patterns. The Beer cluster is assessed as the active rental service used by multiple affiliates, while Analytics appears tied to a single operator using acquired source code.

Campaigns linked to ErrTraffic used stolen WordPress administrator credentials, PHP backdoors, malicious MU-plugins, and fake AI-themed sites impersonating Google Antigravity and ChatGPT to distribute malware including Vidar, Stealc, DanaBot, HijackLoader, Remus, Salat, and SmokeLoader. Separate reporting also exposed a live malware distribution backend after a researcher found an unsecured PHP installer at /install/install.php, allowing administrative access to the panel that managed hosted payloads, dynamic download pages, and multi-stage redirection chains; although the operators patched that weakness, the infrastructure reportedly remains active. Defenders were provided with domains, delivery URLs, and file hashes to support detection and response.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Jun 15, 2026 – Jun 17, 2026

Jun 17, 20264mo ago
Gurucul republishes ErrTraffic findings with IOCs
On 2026-06-17, Gurucul published a threat research notice summarizing the ErrTraffic framework and its use of compromised WordPress sites, ClickFix lures, and EtherHiding. The notice added domains, a malware delivery URL, and file hashes as indicators of compromise while citing the underlying Sekoia research.
Unveiling ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework | Community Portal | Gurucul
Jun 16, 20264mo ago
Sekoia publishes analysis of ErrTraffic MaaS framework
On 2026-06-16, Sekoia published research on ErrTraffic, a Malware-as-a-Service JavaScript framework injected into compromised WordPress sites to deliver ClickFix lures and malware. The report described its use of EtherHiding on the Polygon blockchain, identified the distinct Analytics and Beer clusters, and linked campaigns delivering malware including Vidar, DanaBot, HijackLoader, Stealc, Remus, Salat, and SmokeLoader.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework - Sekoia.io Blog
Jun 15, 20264mo ago
Threat actor patches exposed PHP installation weakness
The operators later fixed the exposed installation page weakness that had allowed administrative takeover of the malware platform. Despite the patch, the malicious infrastructure reportedly remained active and continued distributing malware.
Threat Actor Malware Platform Exposed via Unlocked PHP Installation Page
Jun 15, 20264mo ago
Threat actor restores backend but leaves session token valid
After the dashboard initially returned a 500 Internal Server Error, the threat actor repaired the backend configuration. The researcher was able to regain access because the platform did not invalidate an existing server-side session token.
Threat Actor Malware Platform Exposed via Unlocked PHP Installation Page
Jun 15, 20264mo ago
Researcher gains admin access to malware platform via exposed install page
A security researcher found a live malware distribution platform with an exposed "/install/install.php" endpoint that could be rerun in production, allowing initialization against a controlled MySQL instance and creation of a new administrator account. The access exposed a functioning backend used for malware delivery, including a PHP admin panel, database, hosted payloads, and redirection chains.
Threat Actor Malware Platform Exposed via Unlocked PHP Installation Page

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

LenAI

Malware

1 linked

ErrTraffic

Affected products

1 linked

Wordpress

Organizations

1 linked

Wordpress

Observables

83 linked

Domain••••••.comSHA-1 hash••••••••••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

MD5 hash••••••••••••••••••••••••••••••••URLhttps://•••••••••.•••/••••Domain•••••••••••.ruSHA-1 hash••••••••••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+75

Indicator values are masked on this page. View all 83 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Gurucul Threat ResearchNews · Jun 17, 2026

Unveiling ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework | Community Portal | GuruculOpen source ↗

Sekoia BlogNews · Jun 16, 2026

Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework - Sekoia.io BlogOpen source ↗

Cyber Security NewsNews · Jun 15, 2026

Threat Actor Malware Platform Exposed via Unlocked PHP Installation PageOpen source ↗

UnclassifiedNews · Oct 13, 2023

“EtherHiding” - Hiding Web2 Malicious Code in Web3 Smart ContractsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

command-and-control-methodloader-delivery-mechanismcybercrime-service-ecosystemcredential-stealer-activity

ErrTraffic ClickFix Framework Uses WordPress and Blockchain-Hidden C2 to Spread Malware

Attack Tradecraft · 4 sources · Updated 4mo ago · First seen Jun 17, 2026

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Jun 15, 2026 – Jun 17, 2026

Jun 17, 20264mo ago
Gurucul republishes ErrTraffic findings with IOCs
On 2026-06-17, Gurucul published a threat research notice summarizing the ErrTraffic framework and its use of compromised WordPress sites, ClickFix lures, and EtherHiding. The notice added domains, a malware delivery URL, and file hashes as indicators of compromise while citing the underlying Sekoia research.
Unveiling ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework | Community Portal | Gurucul
Jun 16, 20264mo ago
Sekoia publishes analysis of ErrTraffic MaaS framework
On 2026-06-16, Sekoia published research on ErrTraffic, a Malware-as-a-Service JavaScript framework injected into compromised WordPress sites to deliver ClickFix lures and malware. The report described its use of EtherHiding on the Polygon blockchain, identified the distinct Analytics and Beer clusters, and linked campaigns delivering malware including Vidar, DanaBot, HijackLoader, Stealc, Remus, Salat, and SmokeLoader.
Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework - Sekoia.io Blog
Jun 15, 20264mo ago
Threat actor patches exposed PHP installation weakness
The operators later fixed the exposed installation page weakness that had allowed administrative takeover of the malware platform. Despite the patch, the malicious infrastructure reportedly remained active and continued distributing malware.
Threat Actor Malware Platform Exposed via Unlocked PHP Installation Page
Jun 15, 20264mo ago
Threat actor restores backend but leaves session token valid
After the dashboard initially returned a 500 Internal Server Error, the threat actor repaired the backend configuration. The researcher was able to regain access because the platform did not invalidate an existing server-side session token.
Threat Actor Malware Platform Exposed via Unlocked PHP Installation Page
Jun 15, 20264mo ago
Researcher gains admin access to malware platform via exposed install page
A security researcher found a live malware distribution platform with an exposed "/install/install.php" endpoint that could be rerun in production, allowing initialization against a controlled MySQL instance and creation of a new administrator account. The access exposed a functioning backend used for malware delivery, including a PHP admin panel, database, hosted payloads, and redirection chains.
Threat Actor Malware Platform Exposed via Unlocked PHP Installation Page

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

LenAI

Malware

1 linked

ErrTraffic

Affected products

1 linked

Wordpress

Organizations

1 linked

Wordpress

Observables

83 linked

Domain••••••.comSHA-1 hash••••••••••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+75

Indicator values are masked on this page. View all 83 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Gurucul Threat ResearchNews · Jun 17, 2026

Unveiling ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework | Community Portal | GuruculOpen source ↗

Sekoia BlogNews · Jun 16, 2026

Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework - Sekoia.io BlogOpen source ↗

Cyber Security NewsNews · Jun 15, 2026

Threat Actor Malware Platform Exposed via Unlocked PHP Installation PageOpen source ↗

UnclassifiedNews · Oct 13, 2023

“EtherHiding” - Hiding Web2 Malicious Code in Web3 Smart ContractsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

ErrTraffic ClickFix Framework Uses WordPress and Blockchain-Hidden C2 to Spread Malware

How this story unfolded

Gurucul republishes ErrTraffic findings with IOCs

Sekoia publishes analysis of ErrTraffic MaaS framework

Threat actor patches exposed PHP installation weakness

Threat actor restores backend but leaves session token valid

Researcher gains admin access to malware platform via exposed install page

Related entities

Threat actors

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

ErrTraffic Uses Compromised WordPress Sites and Blockchain Infrastructure to Deliver Malware

ClickFix Malware Campaign Hides Payload Infrastructure in Blockchain Smart Contracts

ErrTraffic Service Automates ClickFix Attacks Using Fake Browser Glitches

ErrTraffic ClickFix Framework Uses WordPress and Blockchain-Hidden C2 to Spread Malware

How this story unfolded

Gurucul republishes ErrTraffic findings with IOCs

Sekoia publishes analysis of ErrTraffic MaaS framework

Threat actor patches exposed PHP installation weakness

Threat actor restores backend but leaves session token valid

Researcher gains admin access to malware platform via exposed install page

Related entities

Threat actors

Malware

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

ErrTraffic Uses Compromised WordPress Sites and Blockchain Infrastructure to Deliver Malware

ClickFix Malware Campaign Hides Payload Infrastructure in Blockchain Smart Contracts

ErrTraffic Service Automates ClickFix Attacks Using Fake Browser Glitches