Threat reportMalwareTL-2026-0817
ErrTraffic: ClickFix Malware-as-a-Service Distribution Framework Delivering Infostealers and Loaders via Compromised WordPress and EtherHiding Polygon C2
ErrTraffic: ClickFix Malware-as-a-Service Distribution (TL-2026-0817), also tracked as ErrTraffic, is a high-severity malware campaign, first published 2026-06-16. It is attributed to LenAI with medium confidence, affects WordPress WordPress (Content Management System), references 1 CVE (CVE-2020-25213), maps to 23 MITRE ATT&CK techniques (T1027.010, T1056.003, T1059.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 23MITRE ATT&CK
- Actors
- 1LenAI
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-0817
- Threat ID
- TL-2026-0817
- Also known as
- ErrTraffic, Beer cluster, Analytics cluster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- LenAI
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, e-commerce, financial, cryptocurrency, web-services
- Target regions
- North America, Europe, Australia, Southeast Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in ErrTraffic: ClickFix Malware-as-a-Service Distribution
Malware and tooling: DanaBot, HijackLoader, Remus, Salat, Smoke Loader - S0226, Stealc, Vidar, 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308, 0x53ffB04Ef13Bc4Cb12CE8Ac7b9532C254338dC3e, 0x5b7F9C87773fFc7FAbEFcBeDFe3527BCE98C328, 0xb36482fE794B895695914779Db3909b471D1aA43
How ErrTraffic: ClickFix Malware-as-a-Service Distribution works
ErrTraffic is a Malware-as-a-Service ClickFix distribution framework that injects malicious JavaScript into compromised WordPress sites to deliver fake BSOD/reCAPTCHA/Cloudflare Turnstile lures, tricking users into running PowerShell that downloads infostealers and loaders. It resolves C2 via EtherHiding on Polygon blockchain smart contracts and routes victims through a Traffic Distribution System. Sold by operator 'LenAI' on Exploit.IN since December 2025, it delivers Vidar, Stealc, Remus, Salat, DanaBot, HijackLoader, and SmokeLoader.
ErrTraffic is an industrialized ClickFix malware-distribution framework operated as a Malware-as-a-Service (MaaS) and documented by Sekoia.io's Threat Detection & Research team in June 2026. The framework is distributed by the threat actor 'LenAI', who has advertised it on the Exploit.IN cybercrime forum and Telegram since December 2025, selling both monthly subscriptions ($300 rising to $380) and full source code ($1,500 rising to $3,000, then $4,500 for lifetime updates).
Initial access to victim infrastructure is achieved primarily through harvested WordPress administrator credentials — frequently stolen by upstream infostealers and surfaced in leak databases — replayed via residential proxies in tight credential-validation bursts (seven geographically distributed IPs validated stolen credentials within an 80-second window on 7 March 2026). After authenticating, operators modify the active theme's functions.php through the legitimate /wp-admin/theme-editor.php interface and deploy PHP backdoors as WordPress MU-plugins (e.g. session-manager.php in the 'Analytics' cluster). An automated toolkit also attempts pre-authentication RCE against the WP File Manager plugin (CVE-2020-25213), though exploitation was observed to be unsuccessful against the analyzed targets.
The deployed PHP backdoors are heavily persistent (a seven-layer model in the Analytics cluster: full MU-plugin copy in the WordPress database, a credential harvester re-injected hourly into wp-login.php, a theme functions.php stub, five scatter PHP files in legitimate directories, disabled automatic updates, and hidden-administrator-account creation). They evade detection by scanning User-Agents for security tooling (Wordfence, Sucuri, WPScan, Nessus, Nikto, Burp) and suspending activity for 30 minutes when such tooling is seen, and they expose multiple covert RCE channels (secret-key GET parameter, HMAC time-windowed cookie, and a REST API endpoint via the X-WP-Session header). The backdoors also perform WooCommerce/Magecart-style payment skimming and host JavaScript visitor analytics beacons.
The injected ErrTraffic JavaScript presents ClickFix social-engineering lures (fake Blue Screen of Death, fake reCAPTCHA, and fake Cloudflare Turnstile verification screens). A Traffic Distribution System (TDS) applies geolocation filtering, OS detection (Windows/macOS), HTTP referrer routing, and browser fingerprinting before serving a payload, and tracks visit/delivery/execution statistics. C2 endpoints are resolved using the EtherHiding 'Dead Drop Resolver' technique: the JavaScript queries Polygon blockchain smart contracts (via Quicknode and public JSON-RPC endpoints) whose state stores the current C2 domains, which rotate daily across rare TLDs (.beer, .cfd, .club, .click, .cyou, .lat, .sbs, .shop, .xyz). Payloads and API traffic are obfuscated with Base64, XOR, and RC4. Victims who follow the lure paste and run a PowerShell command (marked with decoy 'Code Verification' comments) that XOR-decrypts and downloads malware, often padded with binary bloating (120+ MB archives) to evade sandboxing.
Sekoia tracks two principal clusters. The 'Analytics' cluster appears to be a single unattributed operator who purchased an older, less-obfuscated source-code version and distributes Vidar exclusively. The 'Beer' cluster is run by LenAI as the MaaS platform itself, onboarding affiliates (e.g. 'tope'/'cybershell_master' tied to the Bintang campaign, and PPI operator 'mtd') who each receive distinct Polygon smart contracts and deliver a wider set of payloads including Stealc, Remus (a Lumma variant), Salat, DanaBot, HijackLoader, and SmokeLoader, alongside AI-themed impersonation campaigns (Google Antigravity, ChatGPT).
MITRE ATT&CK techniques used in TL-2026-0817
Defense Evasion
T1027.010 Command Obfuscation; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056.003 Web Portal Capture; T1110.004 Credential Stuffing
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1568.002 Domain Generation Algorithms
Initial Access
T1078 Valid Accounts; T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1195.003 Compromise Hardware Supply Chain
Persistence
T1136.001 Local Account; T1505.003 Web Shell
Collection
T1213 Data from Information Repositories
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587.001 Malware
Impact
defense-impairment
Affected products and versions in ErrTraffic: ClickFix Malware-as-a-Service Distribution
- WordPress — WordPress (Content Management System)
Vulnerable versions: administrator-credential-compromised installs - mndpsingh287 / FileManagerPro — WP File Manager plugin
Vulnerable versions: < 6.9
Fixed in: 6.9 - Automattic / WooCommerce — WooCommerce
Vulnerable versions: installs on compromised WordPress sites (Magecart skimming)
Remediation for ErrTraffic: ClickFix Malware-as-a-Service Distribution
Patches
- Update WP File Manager plugin to 6.9 or later to remediate CVE-2020-25213
- Keep WordPress core, themes, and all plugins fully patched
Immediate actions
- Block known ErrTraffic C2 domains and Polygon C2 smart-contract addresses; alert on outbound traffic to rare TLDs (.beer, .cfd, .club, .click, .cyou, .lat, .sbs, .shop, .xyz) immediately followed by PowerShell execution
- Reset all WordPress administrator credentials and enforce MFA; assume any credential exposed in infostealer leak databases is compromised
- Hunt for and remove malicious MU-plugins (e.g. session-manager.php) and scatter PHP backdoors with 8-character HTML-comment markers in /wp-content/mu-plugins/ and theme directories
- Enable PowerShell ScriptBlock logging (Event ID 4104) to catch ClickFix decryption stubs
Workarounds
- Disable WordPress theme/plugin editor in wp-config.php
- Apply WAF rules blocking elFinder connector access for wp-file-manager
- Use application allowlisting to prevent PowerShell-initiated downloads/execution
Longer-term hardening
- Deploy EDR with behavioral detection of clipboard-to-PowerShell ClickFix chains
- Restrict WordPress theme/plugin file editing (DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS) and lock down the admin plane to known IPs
- Implement file-integrity monitoring on functions.php, wp-login.php, .htaccess, user.ini and mu-plugins
- Block Polygon/Quicknode JSON-RPC endpoints from user endpoints where not required to break EtherHiding C2 resolution
CVEs associated with ErrTraffic: ClickFix Malware-as-a-Service Distribution
Weaknesses (CWE) in ErrTraffic: ClickFix Malware-as-a-Service Distribution
Timeline of ErrTraffic: ClickFix Malware-as-a-Service Distribution
- WordPress administrator credential stolen by an upstream infostealer; later surfaces in leak databases.
- Operator 'LenAI' begins advertising the ErrTraffic framework on the Exploit.IN cybercrime forum and Telegram; monthly subscription priced at $300.
- ErrTraffic source code offered for sale at $1,500.
- Stolen administrator credentials become available in public leak databases, enabling later reuse.
- Seven geographically distributed residential-proxy IPs validate the stolen credentials against /wp-login.php within an 80-second window; six receive HTTP 302 (authenticated).
- Two North American IPs access the WordPress admin within a 14-second window to confirm administrator privilege.
- PHP backdoor deployed and theme functions.php modified from IPs 172.59.242.93 and 68.60.174.238; an automated toolkit also attempts (unsuccessfully) CVE-2020-25213 against WP File Manager.
- Bintang campaign ErrTraffic C2 infrastructure goes offline as the affiliate subscription expires.
- LevelBlue SpiderLabs documents ErrTraffic v3 with EtherHiding; source code price rises to $3,000.
- PPI operator 'mtd' posts positive feedback on Exploit.IN praising ErrTraffic conversion rates.
- Domain antigravity.study registered (Global Domain Group) for a Google Antigravity impersonation campaign.
- Domain chatgpt-web.vip registered (Dynadot) for a ChatGPT impersonation campaign delivering HijackLoader.
- Sekoia.io TDR publishes the public 'Unveiling ErrTraffic' report.
Sources cited for ErrTraffic: ClickFix Malware-as-a-Service Distribution
- Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
- LevelBlue SpiderLabs: ErrTraffic v3 EtherHiding analysis
- Monarx: Advanced WordPress backdoor campaign (session-manager.php)
- Hudson Rock: initial ErrTraffic documentation
- Guardio Labs: EtherHiding technique research
- NVD - CVE-2020-25213 (WP File Manager unrestricted file upload RCE)
- MITRE ATT&CK T1102.001 Web Service: Dead Drop Resolver
- Flare.io: infostealer credential leak database tracking
Detection coverage for TL-2026-0817
As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0817 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0817
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.