ErrTraffic/EvilTokens AES-GCM Encrypted ClickFix Landing Page Delivery

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects HTTP responses that utilize JavaScript Web Crypto API (subtle.importKey, subtle.decrypt) or AES-GCM encryption in conjunction with data decoding functions (atob, Uint8Array.from). This behavior is characteristic of malicious landing pages, such as those used by ErrTraffic ClickFix and EvilTokens campaigns, which encrypt payloads to evade static analysis by security tools.