ErrTraffic ClickFix-as-a-Service Campaign Delivers NetSupport RAT via Compromised Gizmodo Account
ErrTraffic ClickFix-as-a-Service Campaign Delivers (TL-2026-0902), also tracked as Gizmodo ClickFix incident, is a high-severity malware campaign, first published 2026-06-22. It is attributed to ErrTraffic affiliate with medium confidence, affects Gizmodo (Gizmodo Media / G/O) Gizmodo website (compromised publishing, maps to 26 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0902
- Threat ID
- TL-2026-0902
- Also known as
- Gizmodo ClickFix incident, ErrTraffic NetSupport campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-22
- Last reviewed
- 2026-06-22
- Attribution
- ErrTraffic affiliate
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- media, technology, general public / consumers
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in ErrTraffic ClickFix-as-a-Service Campaign Delivers
Malware and tooling: NetSupport RAT, NetSupport Manager
On Saturday June 21, 2026, an affiliate of the ErrTraffic ClickFix-as-a-service (MaaS) program abused a compromised Gizmodo account to inject malicious JavaScript that served OS-tailored fake-CAPTCHA (ClickFix) lures, tricking readers into pasting and executing attacker commands. The Windows path deployed NetSupport RAT (weaponized NetSupport Manager), while the macOS payload appeared broken (a password-protected ZIP).
How ErrTraffic ClickFix-as-a-Service Campaign Delivers works
Between user reports on Saturday June 21, 2026 and remediation by the following Monday, visitors to the high-traffic technology news site Gizmodo were briefly served a malicious script injected through a compromised publishing account. The script rendered a fake CAPTCHA / verification overlay (a ClickFix lure) that fingerprinted the visitor's operating system and presented OS-specific instructions to 'verify' themselves. Proofpoint threat researcher Tommy M attributed the activity to an affiliate of ErrTraffic, a ClickFix-as-a-service / Malware-as-a-Service framework first documented in late 2025 that lets affiliates deliver whichever payload they choose through a Traffic Distribution System (TDS).
ClickFix is a manual-execution social-engineering technique: the lure uses clipboard hijacking (navigator.clipboard.writeText) to silently place an obfuscated command on the victim's clipboard, then instructs the user to open the Windows Run dialog (Win+R), paste (Ctrl+V), and press Enter — causing the victim to run the payload themselves and bypassing many automated download protections. For Windows visitors the command launched a hidden PowerShell loader that decoded a base64/JSON blob of embedded files, wrote them into a hidden directory, established persistence via a Startup-folder shortcut and/or HKCU Run key, and launched the legitimate-but-weaponized NetSupport Manager client (client32.exe) configured to beacon to attacker-controlled NetSupport gateways. NetSupport RAT — a 1989-era remote IT support tool (NetSupport Manager) repurposed by criminals — grants full remote control, file upload/download/execute, screen/audio/video capture, keystroke capture, and a foothold for follow-on tooling (Impacket lateral movement, ProcDump credential theft) or ransomware. According to Darktrace, this capability enables file exfiltration and the loading of additional malware or ransomware. The macOS variant was configured but non-functional, requiring a password to open a delivered ZIP archive, so Mac visitors were not infected.
ErrTraffic infrastructure has been observed across multiple hosting providers and clusters, using JavaScript loader domains (e.g. polygon-cnd-stats, mcdns-imager, llc-image-ico[.]click, nero-ns-cdns), an 'ic-tracker-js' style injected script tag, TDS redirect chains (including YOURLS shorteners), and EtherHiding — Polygon-blockchain smart contracts (e.g. 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308) used as dead-drop resolvers to store the next-stage URLs resiliently. The same framework has delivered NetSupport RAT v14.10, Lumma/Vidar/Stealc and other infostealers, and macOS stealers (Odyssey/MacSync) in parallel campaigns. Gizmodo took the site offline, removed the script, and secured the account; no further ClickFix prompts were observed after remediation.
MITRE ATT&CK techniques used in TL-2026-0902
Credential Access
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Collection
T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1189 Drive-by Compromise; T1566 Phishing
Discovery
T1082 System Information Discovery
defense-impairment
Impact
T1486 Data Encrypted for Impact
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
Affected products and versions in ErrTraffic ClickFix-as-a-Service Campaign Delivers
- Gizmodo (Gizmodo Media / G/O) — Gizmodo website (compromised publishing account)
Vulnerable versions: compromised account / injected script, June 2026
Fixed in: account secured, script removed June 2026 - Microsoft — Windows (end-user visitors)
Vulnerable versions: all currently supported Windows running the ClickFix command - Apple — macOS (end-user visitors)
Vulnerable versions: targeted but payload non-functional (password-protected ZIP) - NetSupport Ltd — NetSupport Manager (abused legitimately-signed remote control tool)
Vulnerable versions: v11.30; v12.50; v14.10 (observed in ErrTraffic campaigns)
Remediation for ErrTraffic ClickFix-as-a-Service Campaign Delivers
Immediate actions
- Block the ErrTraffic loader/C2 domains and IPs in this report at the web proxy/DNS and perimeter firewall
- Hunt for NetSupport client32.exe / client32.ini and Startup-folder .url shortcuts on endpoints; isolate hits
- Reset credentials and enforce MFA on the compromised CMS/publishing account; audit recent content changes for injected <script> tags
- Search EDR for the ClickFix execution pattern: explorer.exe -> Run dialog -> powershell -w hidden -nop / mshta / msiexec from a browsing context
Workarounds
- Strip clipboard-write JavaScript and disable copy-to-clipboard on untrusted pages via browser hardening/extensions
- Use script-blocking and reputation-based web filtering to break the TDS redirect chain
Longer-term hardening
- Disable the Windows Run dialog (Win+R) via GPO for standard users where feasible
- Deploy EDR/NGAV with behavioral detection for LOLBins (powershell, mshta, msiexec) spawned from browsers
- Block installation/execution of non-approved RMM tooling (NetSupport, AnyDesk, etc.) via application allowlisting
- User awareness training specifically covering fake-CAPTCHA 'paste and run' lures
- Enforce strong authentication, least privilege, and change monitoring on all CMS/publishing accounts
Weaknesses (CWE) in ErrTraffic ClickFix-as-a-Service Campaign Delivers
CWE-79, CWE-451, CWE-829, CWE-507
Timeline of ErrTraffic ClickFix-as-a-Service Campaign Delivers
- ErrTraffic ClickFix/Malware-as-a-Service framework advertised by operator 'LenAI' on the Exploit.IN forum; first documented publicly in late 2025.
- ErrTraffic 'Analytics' cluster begins using Polygon smart contract 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 as a blockchain (EtherHiding) dead-drop resolver, creating 15+ contracts hosting campaign domains.
- Breakglass Intelligence (Campaign #39) documents large-scale ClickFix fake-CAPTCHA pages dropping NetSupport RAT v14.10 via PowerShell/MSI loaders.
- Reader reports of fake-CAPTCHA prompts surface within hours; Gizmodo takes the site offline, removes the injected script, and secures the compromised account.
- Windows visitors who follow the lure execute a hidden PowerShell loader that installs NetSupport RAT (client32.exe); the macOS payload is non-functional (password-protected ZIP).
- Saturday: a compromised Gizmodo publishing account is used to inject malicious JavaScript serving OS-tailored ClickFix fake-CAPTCHA lures to readers.
- The Register publishes the incident; by Monday no further ClickFix prompts are observed and the incident is considered resolved.
- Proofpoint threat researcher Tommy M attributes the activity to an affiliate of the ErrTraffic ClickFix-as-a-service program.
Sources cited for ErrTraffic ClickFix-as-a-Service Campaign Delivers
- Gizmodo readers hit with ClickFix malware prompts after account compromise
- Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework
- Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic
- Unpacking NetSupport RAT Loaders Delivered via ClickFix
- NetSupport RAT ClickFix Distribution (Security Advisory)
- How NetSupport RAT Abuses Legitimate Remote Admin Tool
- Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign
- Campaign #39: NetSupport RAT Weaponized via ClickFix Social Engineering at Scale
- Behind the Curtain: How the ErrTraffic ClickFix Toolkit is Evolving
- Deploying NetSupport RAT via WordPress & ClickFix
Threats related to ErrTraffic ClickFix-as-a-Service Campaign Delivers
- Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (Decimal Arrays, AES, GZIP)
- AiTM Phishing Becomes Top Initial Access Vector for Law Firms: Tycoon2FA, ClickFix/NetSupport RAT, Teams Vishing (STAC4749), and Lumma Stealer Converge on the Legal Sector
- SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT via Two-Stage Loader (Unidentified Initial RAT, Encoded TCP/443 C2)
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- ErrTraffic: ClickFix Malware-as-a-Service Distribution Framework Delivering Infostealers and Loaders via Compromised WordPress and EtherHiding Polygon C2
- Operation Endgame Dismantles SocGholish (FakeUpdates) Initial-Access Malware Network — 106 Servers and 101 Domains Seized (TA569 / Evil Corp)
Detection coverage for TL-2026-0902
As of 2026-06-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0902 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0902
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.