ErrTraffic ClickFix Browser-to-PowerShell Payload Delivery (Vidar/DanaBot/HijackLoader)
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
YARA-L
