ErrTraffic Exploits Visual Page Breaks to Fuel ClickFix Attacks, Rebranding Exploits as “GlitchFix”
ErrTraffic is a Traffic Distribution System (TDS) engineered to facilitate ClickFix social engineering attacks. Unlike conventional fake update prompts, ErrTraffic intentionally disrupts website visuals by creating garbled text, distorted CSS, and cursor…
ErrTraffic is a Traffic Distribution System (TDS) engineered to facilitate ClickFix social engineering attacks. Unlike conventional fake update prompts, ErrTraffic intentionally disrupts website visuals by creating garbled text, distorted CSS, and cursor jitter to persuade users that their device is malfunctioning.
The method, known as "GlitchFix," has proven effective in misleading users into executing malware under the guise of fixing their systems.
Upon accessing a compromised site containing ErrTraffic code , the attack is initiated instantly. The script evaluates the victim's operating system, browser type, and location. If conditions are met, the page alters, rendering text unreadable, introducing CSS distortions, and causing unusual cursor movements. Within moments, a counterfeit update notification appears, ostensibly from Chrome, Firefox, or Windows.
Security experts identified the threat actor "LenAI" marketing ErrTraffic v2 on Russian forums for approximately $800. The conversion rate, nearly 60%, indicates a significant success rate, with 6 out of 10 individuals interacting with the malicious prompt. This success rate is notable for social engineering tools. The product operates on a subscription model, requiring ongoing payments for continued use.
Browser Update Mode: Simulates updates from Chrome, Firefox, or Edge with localized notifications. Font Mode: Claims a missing system font requires installation.
The domain naming strategy employs low-cost TLDs (.cfd, .art) and free subdomain services (kozow[.]com), favoring minimal identification requirements.
ErrTraffic is a Traffic Distribution System (TDS) engineered to facilitate ClickFix social engineering attacks.
In ClickFix Mode (v3 only), obfuscated PowerShell commands are copied to the clipboard, directing users to press Win+X, then I, then Ctrl+V, then Enter, thereby executing hidden malware installers without window prompts.
ErrTraffic does not distribute traditional malware but deploys digitally-signed Remote Monitoring & Management (RMM) tools: FleetDeck for Windows, ITarian MDM for Android, ConnectWise Control for macOS, and ITarian ITSM for Linux. These tools are generally allowlisted by security software, complicating efforts to block them without affecting legitimate IT operations.
The infrastructure spans the Netherlands, Sweden, and Russia. The tool employs token-based payload delivery, bot detection, and geofencing to exclude specific countries, notably all CIS nations, indicating Russian-speaking threat actors aiming to avoid legal repercussions.
ErrTraffic exemplifies industrialized social engineering with a 60% conversion rate and sophisticated infrastructure, greatly expediting the compromise process. Organizations are advised to enhance user awareness training and limit RMM tool execution to avert infections.
Indicator Type Notes
errtraffic_session= Cookie Session identifier
/api/css.js.php URL path v2 payload
/api/css.js URL path v3 payload (obfuscated)
/api/index.php?action= URL pattern v3 API calls
Based on reporting by GBHackers.