ErrTraffic Beer Cluster DanaBot/Stealc Multi-Stage Payload Download via PowerShell

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•1

Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.