ErrTraffic ClickFix Framework Distributing Malware via EtherHiding

ErrTraffic is an evolving JavaScript-based Malware-as-a-Service (MaaS) framework primarily operated by the threat actor LenAI. It employs the 'ClickFix' social engineering technique, which presents users with fake error messages (e.g., BSOD or reCAPTCHA failures) to trick them into executing malicious PowerShell commands. The framework is notable for its use of the 'EtherHiding' technique, which queries Polygon blockchain smart contracts to retrieve C2 infrastructure, providing a resilient and decentralized dead-drop resolver mechanism.

Two distinct clusters, 'Analytics' and 'Beer', have been identified. The 'Analytics' cluster appears to be operated by a single entity using a consistent PHP backdoor for WordPress persistence, while the 'Beer' cluster serves multiple affiliates distributing varied payloads like Vidar, Stealc, and DanaBot. Beyond WordPress exploitation, campaigns have expanded to include malvertising-driven fake AI websites impersonating Google Antigravity and ChatGPT to target high-value users such as developers and Web3 investors.