ErrTraffic Fueling ClickFix by Breaking the Page Visually and Turns Attack to GlitchFix

A new technique known as GlitchFix has been identified, utilizing ErrTraffic—a traffic distribution system engineered to deceive website visitors into downloading malware via visually disrupted web pages.

The platform is commercially available for approximately $800, providing cybercriminals with a comprehensive toolkit for executing fraudulent campaigns across various operating systems.

ErrTraffic enhances the ClickFix method by intentionally disrupting web pages through visual distortions, prompting users to believe an immediate system update is necessary.

This system targets devices running Windows, macOS, Android, and Linux, and supports eight languages, thus facilitating global reach.

Unlike traditional phishing, this strategy creates an urgent appearance by distorting page content, applying CSS disruptions, and inducing mouse jitter effects, while maintaining the clarity of the fake update prompts.

Censys researchers identified the infrastructure supporting this threat, which includes five physical servers running ErrTraffic panels across three autonomous systems, and hosting eleven unique domains.

The research uncovered two versions of the system: version 2 with unobfuscated JavaScript and Russian-only admin interfaces, and version 3 with XOR-based payload obfuscation and an advanced ClickFix mode.

A misconfigured instance revealed the complete source code, providing detailed insights into the system's operations.

The attack utilizes remote monitoring and management tools disguised as legitimate updates, including FleetDeck, ITarian MDM, and ConnectWise Control, which are often allowlisted by security products, complicating detection.

Infection Mechanism and Attack Workflow

The ErrTraffic system employs a multi-stage infection process initiated when users visit compromised sites containing injected script tags.

The malicious JavaScript, sourced from the ErrTraffic panel, immediately fingerprints the user's browser, operating system, and language settings.

Geographic filtering is then applied using the ipwho.is API to block access from CIS countries, suggesting attribution to Russian-speaking threat actors.

If the user passes geolocation and bot detection checks, the page switches to chaos mode, wherein text becomes unreadable and CSS transformations distort page layouts.

The system tracks dynamic content using MutationObserver APIs to ensure newly loaded elements undergo similar distortion.

After a preset delay, a clean modal appears, offering browser updates, font installations, or PowerShell command execution in version 3.

Upon clicking the update button, a download token is requested from the panel server, with token-based delivery preventing researchers from accessing payloads without engaging with the full attack workflow.

After validation, operating system-specific RMM installers are served through hidden iframes, establishing persistent remote access.

Version 3's ClickFix mode circumvents standard download protections by copying obfuscated PowerShell commands to clipboards, guiding users to execute terminal commands manually.

The platform's evasion tactics include bot detection patterns targeting security scanners and automated tools. Detection signatures depend on errtraffic_session cookies and specific API paths such as /api/css.js.php for version 2 and /api/css.js for version 3.

The infrastructure utilizes economical top-level domains and free subdomain services, with some panels imitating government agencies.

Defenders should prioritize network monitoring for errtraffic_session cookies, educate users about fake update prompts, and monitor unusual RMM tool installations.

The malware-as-a-service model incorporates subscription features, with rental expiration fields suggesting ongoing development and operator support beyond the initial purchase price.

Based on reporting by Cyber Security News.