ErrTraffic Beer Cluster ClickFix lure from AI-impersonation malvertising domains

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•4

Detects network connections or DNS queries to ErrTraffic Beer cluster domains impersonating AI platforms (ChatGPT, Google Antigravity) delivering DanaBot/HijackLoader via BSOD or reCAPTCHA ClickFix lures, and subsequent browser-spawned PowerShell execution.