# ErrTraffic ClickFix-as-a-Service Campaign Delivers NetSupport RAT via Compromised Gizmodo Account

> On Saturday June 21, 2026, an affiliate of the ErrTraffic ClickFix-as-a-service (MaaS) program abused a compromised Gizmodo account to inject malicious JavaScript that served OS-tailored fake-CAPTCHA (ClickFix) lures, tricking readers into pasting and executing attacker commands. The Windows path deployed NetSupport RAT (weaponized NetSupport Manager), while the macOS payload appeared broken (a password-protected ZIP).

- **Published:** 2026-06-22T00:00:00Z
- **Last reviewed:** 2026-06-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0902
- **ID:** TL-2026-0902
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** ErrTraffic affiliate
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between user reports on Saturday June 21, 2026 and remediation by the following Monday, visitors to the high-traffic technology news site Gizmodo were briefly served a malicious script injected through a compromised publishing account. The script rendered a fake CAPTCHA / verification overlay (a ClickFix lure) that fingerprinted the visitor's operating system and presented OS-specific instructions to 'verify' themselves. Proofpoint threat researcher Tommy M attributed the activity to an affiliate of ErrTraffic, a ClickFix-as-a-service / Malware-as-a-Service framework first documented in late 2025 that lets affiliates deliver whichever payload they choose through a Traffic Distribution System (TDS).

ClickFix is a manual-execution social-engineering technique: the lure uses clipboard hijacking (navigator.clipboard.writeText) to silently place an obfuscated command on the victim's clipboard, then instructs the user to open the Windows Run dialog (Win+R), paste (Ctrl+V), and press Enter — causing the victim to run the payload themselves and bypassing many automated download protections. For Windows visitors the command launched a hidden PowerShell loader that decoded a base64/JSON blob of embedded files, wrote them into a hidden directory, established persistence via a Startup-folder shortcut and/or HKCU Run key, and launched the legitimate-but-weaponized NetSupport Manager client (client32.exe) configured to beacon to attacker-controlled NetSupport gateways. NetSupport RAT — a 1989-era remote IT support tool (NetSupport Manager) repurposed by criminals — grants full remote control, file upload/download/execute, screen/audio/video capture, keystroke capture, and a foothold for follow-on tooling (Impacket lateral movement, ProcDump credential theft) or ransomware. According to Darktrace, this capability enables file exfiltration and the loading of additional malware or ransomware. The macOS variant was configured but non-functional, requiring a password to open a delivered ZIP archive, so Mac visitors were not infected.

ErrTraffic infrastructure has been observed across multiple hosting providers and clusters, using JavaScript loader domains (e.g. polygon-cnd-stats, mcdns-imager, llc-image-ico[.]click, nero-ns-cdns), an 'ic-tracker-js' style injected script tag, TDS redirect chains (including YOURLS shorteners), and EtherHiding — Polygon-blockchain smart contracts (e.g. 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308) used as dead-drop resolvers to store the next-stage URLs resiliently. The same framework has delivered NetSupport RAT v14.10, Lumma/Vidar/Stealc and other infostealers, and macOS stealers (Odyssey/MacSync) in parallel campaigns. Gizmodo took the site offline, removed the script, and secured the account; no further ClickFix prompts were observed after remediation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1189 Drive-by Compromise
- T1078 Valid Accounts
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1564 Hide Artifacts
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1113 Screen Capture
- T1056 Input Capture
- T1123 Audio Capture
- T1021 Remote Services
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [Gizmodo readers hit with ClickFix malware prompts after account compromise](https://www.theregister.com/security/2026/06/22/gizmodo-readers-hit-with-clickfix-malware-prompts-after-account-compromise/5259226)
- [Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework](https://blog.sekoia.io/unveiling-errtraffic-inside-a-growing-clickfix-malware-distribution-framework/)
- [Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic](https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/)
- [Unpacking NetSupport RAT Loaders Delivered via ClickFix](https://www.esentire.com/blog/unpacking-netsupport-rat-loaders-delivered-via-clickfix)
- [NetSupport RAT ClickFix Distribution (Security Advisory)](https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution)
- [How NetSupport RAT Abuses Legitimate Remote Admin Tool](https://www.picussecurity.com/resource/blog/how-netsupport-rat-abuses-legitimate-remote-admin-tool)
- [Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign](https://www.levelblue.com/blogs/spiderlabs-blog/err-hiding-and-seek-how-errtraffic-v3-leverages-etherhiding-in-clickfix-campaign)
- [Campaign #39: NetSupport RAT Weaponized via ClickFix Social Engineering at Scale](https://intel.breakglass.tech/post/campaign-39-netsupport-rat-weaponized-via-clickfix-social-engineering-at-scale)
- [Behind the Curtain: How the ErrTraffic ClickFix Toolkit is Evolving](https://www.trinitycyber.com/blog/behind-the-curtain-clickfix-errtraffic-toolkit-is-evolving)
- [Deploying NetSupport RAT via WordPress & ClickFix](https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0902