Sekoia Details ErrTraffic ClickFix Framework and Two Operator Clusters
Summary
Sekoia's investigation links ErrTraffic, a ClickFix malware-as-a-service framework, to two clusters using Polygon smart contracts to resolve C2. Forensic analysis details WordPress compromises, backdoors, malware campaigns, AI-themed lures and detection options.
Key points
- Sekoia describes ErrTraffic as a JavaScript ClickFix distribution framework sold as malware-as-a-service and deployed on compromised WordPress sites; Polygon smart contracts conceal and resolve command-and-control infrastructure.
- The investigation distinguishes an Analytics cluster, associated with Vidar and one smart contract, from a Beer cluster using multiple contracts to distribute varied payloads, including infostealers and loaders.
- In one victim investigation, logs showed access using valid administrator credentials. The attacker modified the WordPress theme to install a persistent MU-plugin backdoor; attempted exploitation of CVE-2020-25213 failed because the affected plugin was absent.
- The analyzed backdoor included credential harvesting, multiple webshell access methods, anti-detection behavior, persistence mechanisms, and a component that collected WooCommerce order data.
- Sekoia reports that a Google Antigravity-themed lure delivered DanaBot and a ChatGPT-themed lure delivered HijackLoader; the assessment that these sites were promoted through malvertising is presented as suspected.
- The report proposes detecting ErrTraffic through PowerShell ScriptBlockText patterns or by correlating blockchain-service access, a connection to a rare-TLD domain, and subsequent PowerShell execution. ScriptBlockText logging may not be enabled or collected by default.
Article Details
- Attack Vectors
- Attackers used stolen WordPress administrator credentials to access compromised sites; the observed login pattern was assessed as consistent with credential stuffing through residential proxies.
- An operator attempted to exploit CVE-2020-25213 against WP File Manager, but the attempt failed because the plugin was not installed on the affected site.
- After gaining administrator access, an attacker edited the active WordPress theme's functions.php file to deploy a dropper that wrote a malicious MU-plugin backdoor.
- ErrTraffic injected ClickFix lures into compromised WordPress sites and attacker-controlled sites impersonating Google Antigravity and ChatGPT. The lures prompted visitors to copy and execute PowerShell commands that downloaded malware.
- ErrTraffic's smart-contract resolution retrieves C2 domains. The Beer cluster also uses API requests to retrieve lures and commands; its fake AI-platform sites were assessed as possibly promoted through malvertising.
- Defensive Notes
- Where PowerShell ScriptBlockText logging is available, detect ErrTraffic command patterns including a leading '<', '#>', '-bxor[int][char]$', '[convert]::ToInt32', and '-lt'. The article notes that this logging is not enabled by default.
- Correlate a connection to blockchain RPC services, a subsequent connection to a rare-TLD domain associated with ErrTraffic, and the immediate launch of PowerShell on the same asset.
- Scan WordPress servers for the backdoor patterns and fixed paths identified in the report, including the session-manager.php MU-plugin and ErrTraffic injector files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | antigravity[.]study | Attacker-controlled site impersonating Google Antigravity and delivering an ErrTraffic ClickFix lure and malware. |
| DOMAIN | chatgpt-web[.]vip | Attacker-controlled site impersonating ChatGPT and delivering an ErrTraffic ClickFix lure and malware. |
| DOMAIN | defi-xstocks[.]vip | Domain reported to redirect to the malicious ChatGPT-impersonation site chatgpt-web[.]vip. |
| DOMAIN | llc-image-ico[.]click | ErrTraffic Beer-cluster domain used to serve the ClickFix injection script from its /api/css.js endpoint. |
| DOMAIN | webanalytics-cdn[.]sbs | Domain to which the Analytics-cluster backdoor exfiltrates visitor cookies. |
| IPV4 | 172[.]59[.]242[.]93 | Attacker-used residential IP observed during deployment of the WordPress backdoor. |
| IPV4 | 68[.]60[.]174[.]238 | Attacker-used residential IP observed during deployment of the WordPress backdoor. |
| IPV4 | 96[.]178[.]187[.]175 | Attacker-used residential proxy IP observed successfully logging into the compromised WordPress administrator account. |
| IPV4 | 96[.]181[.]156[.]219 | Attacker-used residential proxy IP observed successfully logging into the compromised WordPress administrator account. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationErrTraffic scripts and payload commands used Base64, XOR, JavaScript obfuscation, and, in the Beer cluster, RC4 encryption.T1056.003 · Web Portal CaptureThe PHP backdoor intercepted WordPress login attempts and stored harvested credentials in files disguised as images.T1059.001 · PowerShellClickFix-delivered PowerShell commands downloaded and executed the malware payloads.T1071.001 · Web ProtocolsErrTraffic communicated with C2 infrastructure through HTTP API endpoints, including /cf.js, /api/css.js, and /api/index.php.T1078 · Valid AccountsThe attacker used valid WordPress administrator credentials to access the compromised site.T1102.001 · Dead Drop ResolverErrTraffic queried Polygon smart contracts as a dead-drop resolver to retrieve C2 domains.T1105 · Ingress Tool TransferPowerShell commands downloaded payloads, including an MSI loader and, in some cases, a 7z executable and an archive.T1110.004 · Credential StuffingSeven IP addresses each submitted a single POST to the victim's /wp-login.php; the distributed pattern was assessed as consistent with credential stuffing.T1140 · Deobfuscate/Decode Files or InformationThe injected scripts decoded Base64- and XOR-encoded payloads before retrieving or executing subsequent stages.T1190 · Exploit Public-Facing ApplicationThe operator attempted to exploit CVE-2020-25213 through WP File Manager's administrative endpoint, but the attempt was ineffective because the plugin was absent.T1204.004 · Malicious Copy and PasteClickFix lures prompted visitors to copy and execute attacker-provided commands, including PowerShell commands.T1505.003 · Web ShellA malicious WordPress MU-plugin provided a webshell with remote execution, PHP evaluation, file-management, and SQL-query functions.T1539 · Steal Web Session CookieA hidden PHP script on the compromised WordPress site exfiltrated cookies to webanalytics-cdn[.]sbs.
CVE
Threat Actors
cybershell_masterThe article identifies cybershell_master as an alias of tope, whom Sekoia TDR assessed with high confidence to be an ErrTraffic customer deploying the framework on compromised WordPress sites.LenAILenAI advertised and sold ErrTraffic as a MaaS offering. Sekoia TDR assessed with high confidence that LenAI operates the Beer cluster and provides it to affiliates.mtdThe article reports that mtd advertised a PPI service and recommended ErrTraffic; analysts hypothesized that mtd may use the framework to distribute malware through that service.topeSekoia TDR assessed with high confidence that tope is an ErrTraffic customer who deploys the framework on compromised WordPress sites. The article identifies tope as an alias of cybershell_master.
Malware
DanabotThe impersonated AI platform campaign, supposedly using malvertising to spread an attacker-controlled site impersonating Google Antigravity and delivering Danabot.HijackLoaderand automated sandbox scanning. In this instance, the final payload delivered was identified as HijackLoader.RemusTLD. This cluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.Salatcluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.SmokeLoaderfamilies (Vidar, Stealc, Remus, Salat) and undocumented ones, as well as RATs and loaders (e.g. SmokeLoader).StealCthe .beer TLD. This cluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.Vidarwallet address 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 to retrieve the C2 domains and fetch Vidar infostealer payloads during April and May 2026.
Vendors
Products
ChatGPTCampaigns also rely on fake websites impersonating AI platforms such as Google Antigravity and ChatGPT to reach developers.Google AntigravityCampaigns also rely on fake websites impersonating AI platforms such as Google Antigravity and ChatGPT to reach developers.WooCommerceSkimming: A PHP component functions as a skimmer specifically targeting WooCommerce order data. With every new order, fields such as billing_first_name, billing_email, billing_phone, billing_country, order_total, andWordPressErrTraffic is a JavaScript framework injected into compromised WordPress sites to deliver ClickFix lures and distribute malware.