cyber.hendryadrian.com
Threat Research · circleid.com

DNS Investigation Maps ErrTraffic ClickFix Infrastructure

· Original article ↗

Summary

DNS/WHOIS analysis of 71 ErrTraffic ClickFix domain indicators found 12 of 16 associated IPs flagged as malicious, 12 email-connected domains, and historical resolution data. Sekoia reported WordPress-focused clusters and fake AI lures; LenAI involvement was suspected.

Key points

  • Sekoia analyzed the ErrTraffic ClickFix distribution framework and identified 71 domain indicators.
  • The two studied clusters focused on WordPress servers, used a built-in traffic distribution system, concealed C2 infrastructure within blockchain infrastructure, and used fake AI tools such as Google Antigravity and ChatGPT as lures.
  • Researchers suspected LenAI involvement but assessed that the Analytics and Beer clusters were likely operated by different, unnamed threat actors.
  • The DNS analysis found eight client IP addresses communicating with six domain indicators in 45 DNS queries from April 20 to June 15, 2026, across four ASNs.
  • The article reports that 30 indicators resolved to 16 IP addresses, 12 of which were identified as weaponized in other malicious campaigns.
  • Historical DNS data showed 566 domain-to-IP resolutions for 70 indicators; the article says all 70 continued to resolve in 2026.
  • Reverse WHOIS searches found 12 email-connected domains. The analysis also identified typosquatting groups involving finework[.]top and sandman[.]bond.

Article Details

Attack Vectors
  • The campaign used the ErrTraffic ClickFix distribution framework and focused on WordPress servers.
  • Fake AI tools, including Google Antigravity and ChatGPT, were used as lures.
  • The clusters reportedly used a built-in TDS function and concealed command-and-control infrastructure within blockchain-related infrastructure.
Defensive Notes
  • The article recommends corroborating threat findings with supplementary investigation, noting that entities initially identified as malicious may later be deemed harmless.

Indicators of compromise

TypeIndicatorContext
DOMAINabrikos[.]xyzErrTraffic domain IoC with historical domain-to-IP resolutions recorded from March 2022 to May 2026.
DOMAINanakondabob[.]clubErrTraffic domain IoC with historical domain-to-IP resolutions recorded in May 2026.
DOMAINbobik[.]cfdErrTraffic domain IoC with historical domain-to-IP resolutions recorded in May 2026.
DOMAINcloud-safe[.]clickErrTraffic domain IoC reported in the First Watch Malicious Domains Data Feed as likely registered with malicious intent.
DOMAINfinework[.]topErrTraffic domain IoC; reported as bulk-registered with look-alike domains and associated with typosquatting.
DOMAINsandman[.]bondErrTraffic domain IoC; reported as bulk-registered with look-alike domains and associated with typosquatting.
DOMAINwebanalytics-cdn[.]sbsErrTraffic domain IoC with historical domain-to-IP resolutions recorded from February to April 2026.

MITRE ATT&CK

T1036 · MasqueradingThe investigation found campaign domains in typosquatting groups and reported look-alike domains registered alongside finework[.]top and sandman[.]bond.T1566 · PhishingThe campaign used fake AI tools, including Google Antigravity and ChatGPT, as lures to draw victims into the activity.T1583.001 · DomainsThe investigation identified 71 campaign domain IoCs, including domains reported as bulk-registered with look-alikes.

Threat Actors

LenAISekoia researchers believed LenAI, described as a MaaS operator, may be behind the attacks; they also reported that LenAI was behind the Aeternum C&C botnet. The researchers thought the Analytics and Beer clusters were likely launched by different, unnamed threat actors.

Products

ChatGPTFake AI tools such as Google Antigravity and ChatGPT were used as lures.ClickFixThe campaign leveraged the ErrTraffic ClickFix malware distribution framework.ErrTrafficThe campaign leveraged the ErrTraffic ClickFix malware distribution framework.Google AntigravityFake AI tools such as Google Antigravity and ChatGPT were used as lures.WordPressThe activity focused on WordPress servers and used a built-in TDS function.

Related Articles