ErrTraffic ClickFix Framework Uses Blockchain to Hide C2 and Deliver Malware
Summary
Sekoia analyzed ErrTraffic, a ClickFix malware distribution framework used in campaigns that compromise WordPress sites and impersonate AI platforms. Its two clusters use Polygon smart contracts to resolve C2 infrastructure and deliver multiple malware families.
Key points
- ErrTraffic is a malware-as-a-service JavaScript framework that injects ClickFix lures into compromised WordPress sites and attacker-controlled pages.
- The framework uses Polygon smart contracts to conceal and update C2 infrastructure; Sekoia identified separate “Analytics” and “Beer” clusters.
- Attackers gained WordPress access using stolen administrator credentials and installed persistent PHP backdoors, including webshells and credential-harvesting features.
- The campaigns delivered infostealers including Vidar, Stealc, Remus and Salat, as well as RATs and loaders such as SmokeLoader, DanaBot and HijackLoader.
- Some attacker-controlled sites impersonated Google Antigravity and ChatGPT to lure developers and AI researchers with ClickFix prompts.
- Sekoia assesses that the Beer cluster supports multiple affiliates, with campaigns using distinct smart contracts and payloads.
- The article describes detection approaches based on PowerShell command patterns or correlating blockchain-service connections, rare-TLD C2 traffic and subsequent PowerShell execution.
Article Details
- Attack Vectors
- Compromised WordPress sites inject malicious JavaScript that displays ClickFix lures impersonating CAPTCHA checks, Windows crashes, or font problems and persuades visitors to execute malicious commands.
- Attackers accessed WordPress administrator accounts using valid credentials. Infostealer-based credential theft was considered likely in the investigated cases; Flare.io reported that one compromised account had appeared in credential leak databases.
- An investigated operator attempted a plugin-based remote-code-execution path alongside credential-based deployment, but the targeted plugin was absent and the requests failed.
- Attackers modified active theme files to deploy persistent PHP implants and used webshells to maintain access, inject the distribution framework, and update compromised sites.
- Compromised web design and SEO service-provider accounts potentially enabled access to multiple client websites; several infected sites shared the same agency.
- Attacker-controlled websites impersonated AI platforms and delivered ClickFix lures to developers and AI researchers. Promotion through malvertising was suspected, not confirmed.
- Injected scripts resolved C2 infrastructure through blockchain smart contracts, retrieved lure content, and supplied PowerShell commands that downloaded and executed malware.
- Defensive Notes
- Enable and collect PowerShell ScriptBlockText logging. The report proposes detecting scripts beginning with '<' and containing '#>', '-bxor[int][char]$', '[convert]::ToInt32', and '-lt'. This logging is not enabled by default and is not consistently collected.
- Hunt for the distinctive PowerShell comment pattern '<# Code Verification: 656560395146 #>' reported in commands delivered by the framework.
- Correlate a blockchain-service request, a subsequent connection to an unusual C2 TLD such as .beer or .monster, and immediate PowerShell execution on the same asset.
- Inspect WordPress installations for persistent MU-plugins, modified theme files, hidden PHP stubs, authentication hooks, database-resident implant copies, altered user.ini and .htaccess files, and disabled automatic updates.
- Account for scan evasion: the investigated implant suspends malicious functionality for 30 minutes when incoming User-Agent strings match known security tools.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | antigravity[.]study | Attacker-controlled AI-platform impersonation site delivering a BSOD-themed ClickFix lure and an MSI loader that delivered DanaBot. |
| DOMAIN | chatgpt-web[.]vip | Malicious ChatGPT impersonation site delivering a reCAPTCHA-themed ClickFix lure and HijackLoader. |
| DOMAIN | defi-xstocks[.]vip | Domain associated with the malicious ChatGPT site's hosting IP and redirecting visitors to chatgpt-web[.]vip. |
| DOMAIN | llc-image-ico[.]click | ErrTraffic infrastructure pre-resolved by an older Beer-cluster injection before loading the malicious JavaScript. |
| DOMAIN | webanalytics-cdn[.]sbs | Destination receiving cookies exfiltrated by a hidden PHP script loaded through auto_prepend_file. |
| IPV4 | 172[.]59[.]242[.]93 | Residential IP used by the operator during WordPress backdoor deployment on 12 March 2026. |
| IPV4 | 68[.]60[.]174[.]238 | Residential IP used by the operator during WordPress backdoor deployment on 12 March 2026. |
| IPV4 | 96[.]178[.]187[.]175 | Residential IP used by the attacker to authenticate to the investigated WordPress site and validate administrator privileges on 8 March 2026. |
| IPV4 | 96[.]181[.]156[.]219 | Residential IP used by the attacker to authenticate to the investigated WordPress site and validate administrator privileges on 8 March 2026. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationInjected scripts and droppers used Base64, XOR, and text encoding; the Responsive Webshell concealed PHP function names as hexadecimal strings.T1027.001 · Binary PaddingThe ChatGPT-themed delivery chain used an archive exceeding 120 MB, described as binary bloating intended to evade static analysis and sandbox scanning.T1056.003 · Web Portal CaptureThe WordPress implant intercepted login attempts through authentication hooks and stored captured credentials in files disguised as images.T1059.001 · PowerShellDelivered PowerShell commands decrypted embedded strings, downloaded payloads, extracted archives in some cases, and executed malware.T1059.007 · JavaScriptInjected JavaScript resolved C2 addresses through blockchain contracts and retrieved ClickFix lure content.T1070.004 · File DeletionAfter writing the persistent MU-plugin, the deployment dropper removed itself from the active theme's functions.php file.T1078 · Valid AccountsAttackers used valid WordPress administrator credentials to access sites and deploy PHP backdoors.T1082 · System Information DiscoveryThe Responsive Webshell's Server Info module checked server capabilities, available functions, and PHP execution restrictions.T1090.002 · External ProxyResearchers concluded that the investigated operator routed authentication, deployment, and continuing webshell access through residential proxy infrastructure.T1102.001 · Dead Drop ResolverErrTraffic queried Polygon smart contracts as dead-drop resolvers to retrieve changing C2 domains.T1105 · Ingress Tool TransferThe infection chain downloaded malicious JavaScript, executable payloads, MSI files, and archives; some commands also downloaded 7z for extraction.T1110.004 · Credential StuffingSeven geographically distributed IPs submitted single login requests in an 80-second window; researchers assessed the pattern as consistent with distributed validation of stolen credentials.T1136 · Create AccountAuthenticated requests to the implant's scatter stubs could create a hidden administrator account.T1140 · Deobfuscate/Decode Files or InformationDroppers decoded Base64 payloads, injected scripts decoded subsequent stages, and PowerShell decrypted XOR-obfuscated download-and-execute instructions.T1189 · Drive-by CompromiseCompromised WordPress pages and attacker-controlled impersonation sites delivered malicious JavaScript and ClickFix lures to visitors.T1190 · Exploit Public-Facing ApplicationThe operator attempted the WP File Manager remote-code-execution path, but the plugin was absent and the requests returned HTTP 403.T1204 · User ExecutionClickFix lures persuaded visitors to execute supplied commands under the pretext of resolving CAPTCHA, crash, or display problems.T1505.003 · Web ShellPHP webshells provided persistent remote access with shell execution, PHP evaluation, file operations, and SQL-query capabilities.T1539 · Steal Web Session CookieA hidden PHP script loaded through user.ini exfiltrated cookies to webanalytics-cdn[.]sbs.T1562.001 · Disable or Modify ToolsThe implant suspended malicious blocks when security-tool User-Agent signatures were detected and disabled automatic updates as part of its persistence.T1573.001 · Symmetric CryptographyBeer-cluster scripts used RC4 encryption for C2 communications and received RC4-encrypted commands through the API.
CVE
People
Threat Actors
AnalyticsTracked ErrTraffic cluster using a stable Polygon contract, a consistent PHP backdoor, and Vidar delivery. Researchers assess that its infrastructure is operated by a single unidentified actor, likely using purchased source code.BeerTracked ErrTraffic cluster supporting multiple malware-distribution affiliates and distinct smart contracts. Researchers assess with high confidence that its MaaS infrastructure is operated by LenAI.cybershell_masterTelegram identity explicitly linked to tope. Researchers assess with high confidence that the actor is an ErrTraffic subscription customer deploying the framework on compromised WordPress sites.DummyNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.Ghost_devilNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.Jesse_DNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.LenAIAdvertised and sold ErrTraffic on Exploit.IN and Telegram since at least December 2025. Sekoia assesses with high confidence that LenAI operates the Beer cluster as a MaaS subscription offering.MasonDexNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.mtdAdvertised a Windows and macOS PPI service and recommended ErrTraffic. Researchers hypothesise that mtd uses ErrTraffic to distribute malware through that service.mudilaAlleged ErrTraffic affiliate who praised the service and claimed a 10% infection conversion rate.Specta666Named by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.topeExplicitly identified as also using cybershell_master. Researchers assess with high confidence that this ErrTraffic customer uses webshell expertise to deploy the framework; attribution to the investigated Indonesian-linked activity remains analytical.VasyavasilyevNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.willardNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.yayoNamed by the source as a threat actor who recommended ErrTraffic or expressed interest in its forum thread; affiliation remains alleged.
Malware
ClearFake(MaaS) model, it integrates a Traffic Distribution System (TDS) function. Similar to the ClearFake threat, it employs the EtherHiding technique as Dead Drop Resolver (DDR) to conceal its command andDanabotThe impersonated AI platform campaign, supposedly using malvertising to spread an attacker-controlled site impersonating Google Antigravity and delivering Danabot.ErrTrafficUnveiling ErrTraffic: inside a growing ClickFix malware distribution frameworkHIJACKLOADERand automated sandbox scanning. In this instance, the final payload delivered was identified as HijackLoader.IClickFixTo protect our customers from ErrTraffic and other ClickFix-based frameworks (ClearFake, IClickFix), Sekoia.io analysts will continue proactive monitoring of these threats and tracking their C2 infrastructure.RemusTLD. This cluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.Salatcluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.SmokeLoaderfamilies (Vidar, Stealc, Remus, Salat) and undocumented ones, as well as RATs and loaders (e.g. SmokeLoader).StealCthe .beer TLD. This cluster distributes several malware families, including infostealers such as Vidar, Stealc, Remus and Salat.Vidarwallet address 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 to retrieve the C2 domains and fetch Vidar infostealer payloads during April and May 2026.
Vendors
DynadotThe malicious domain chatgpt-web[.]vip mimics the official ChatGPT landing page and was registered on 22 May 2026, via Dynadot.Global Domain GroupThe domain was registered on 15 May 2026 through the Global Domain Group and is hosted on a shared server. The website’s design replicates the branding and infographics typically associated with official Google softwareQuickNodecluster interacts with the Polygon blockchain by querying various public RPC endpoints, mainly Quicknode. Several wallet addresses are used, according to the deployed ErrTraffic framework, to retrieve C2
Products
ChatGPTCampaigns also rely on fake websites impersonating AI platforms such as Google Antigravity and ChatGPT to reach developers.Google AntigravityCampaigns also rely on fake websites impersonating AI platforms such as Google Antigravity and ChatGPT to reach developers.macOSA TDS implementing geofiltering, malware targeting based on HTTP Referrer routing and OS detection supporting Windows and macOS hosts.Microsoft WindowsClickFix lures impersonating Cloudflare, reCAPTCHA, Windows blue screen and font issues via the ErrTraffic frameworkThis turnkey TDS enables affiliates to spread malicious payloads effectively through compromisedPolygonThe framework uses the EtherHiding technique, concealing its C2 infrastructure in Polygon blockchain smart contracts.PowerShellPowerShell command lines for downloading the malicious payload.WooCommerceSkimming: A PHP component functions as a skimmer specifically targeting WooCommerce order data. With every new order, fields such as billing_first_name, billing_email, billing_phone, billing_country, order_total, andWordPressErrTraffic is a JavaScript framework injected into compromised WordPress sites to deliver ClickFix lures and distribute malware.WP File Managerphases, all of which return an HTTP 403 status. This URL is the administrative entry point for the WP File Manager plugin, which is affected by CVE-2020-25213 (a pre-authentication RCE vulnerability). As the plugin
Tools
Burprequests for signatures of known security tools (such as Wordfence, Sucuri, WPScan, Nessus, Nikto, and Burp). If detected, it suspends all malicious blocks using a WordPress transient for 30 minutes, rendering theNessusof incoming requests for signatures of known security tools (such as Wordfence, Sucuri, WPScan, Nessus, Nikto, and Burp). If detected, it suspends all malicious blocks using a WordPress transient for 30Niktoof incoming requests for signatures of known security tools (such as Wordfence, Sucuri, WPScan, Nessus, Nikto, and Burp). If detected, it suspends all malicious blocks using a WordPress transient for 30 minutes,Responsive WebshellResponsive webshellWPScanthe User-Agent of incoming requests for signatures of known security tools (such as Wordfence, Sucuri, WPScan, Nessus, Nikto, and Burp). If detected, it suspends all malicious blocks using a WordPress transient for
Countries
AustraliamacOS payloads, offering “traffic” worldwide, specifically in the United States, Canada, Europe, and Australia. On 19 April 2026, the cybercriminal posted the following feedback in the ErrTraffic thread,Canadaservice for Windows and macOS payloads, offering “traffic” worldwide, specifically in the United States, Canada, Europe, and Australia. On 19 April 2026, the cybercriminal posted the following feedback in theIndonesiafinding correlates with the filtering implemented by the ClickFix API, which blocks infections within Indonesia associated with this campaign. Taken together, these factors suggest that the operator of the “bintang”United Statesa PPI service for Windows and macOS payloads, offering “traffic” worldwide, specifically in the United States, Canada, Europe, and Australia. On 19 April 2026, the cybercriminal posted the following feedback in
Industries
Cryptocurrencypreviously documented by LevelBlue and other threat reports, relies on the Polygon blockchain and the cryptocurrency wallet address 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 to retrieve the C2 domains and fetch Vidarweb design and SEO servicesNotably, the compromised account is associated with an employee of a firm providing web design and SEO services. During our analysis, we identified several compromised sites whose only common denominator was being