New Cybercrime Tool “ErrTraffic” Enables Automated ClickFix Attacks

Cybersecurity: Introduction of ErrTraffic v2

Hudson Rock researchers have identified ErrTraffic v2, a ClickFix-as-a-Service platform that significantly advances the industrialization of deceptive social engineering tactics.

The tool is priced at $800 and is available on Russian cybercrime forums. It represents a pivotal development in the democratization of cybercrime infrastructure.

ClickFix attacks exploit a vulnerability in the interface between browser defenses and operating system execution. Instead of silent downloads, which are often blocked by browsers like Chrome and Edge, attackers use fake system errors. These errors prompt users to execute commands via PowerShell or the Windows Run dialog, effectively bypassing Endpoint Detection and Response (EDR) solutions.

ErrTraffic turns this method into a streamlined operation, with conversion rates nearing 60%. The platform utilizes "fake glitch" rendering, injecting corrupted text and visual artifacts into websites to simulate system failures.

ErrTraffic is promoted by a threat actor named "LenAI" and offers a dashboard with detailed metrics on campaign efficacy. The tool injects HTML into compromised websites to load malicious JavaScript and executes server-side PHP logic for filtering and OS fingerprinting. This allows for tailored payload delivery based on the victim's operating system.

The platform functions as a traffic distribution system. Windows users receive infostealers like Lumma or Vidar; Android users encounter banking trojans disguised as browser updates; and macOS targets receive variants of Atomic Stealer.

ErrTraffic accelerates the cycle of cybercrime by capturing CMS administrative logins, which are then used to compromise additional websites and distribute the tool further. This cycle is expedited by the platform's high conversion rates and affordability.

The tool's impact extends beyond individual infections, as stolen credentials can be sold to ransomware groups and nation-state actors. Traditional perimeter security measures are insufficient against these tactics, highlighting the need for credential intelligence and rapid compromise detection.

In conclusion, the threat landscape is evolving, with a focus on exploiting vulnerabilities in human judgment rather than technical code. Organizations are encouraged to adopt real-time monitoring and behavioral analytics to counter these sophisticated attacks.

Based on reporting by GBHackers.