ErrTraffic ClickFix PowerShell De-obfuscation

Ethan Andrews@eandrews

•updated Jun 16, 2026•12•0•61

Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.