New Cybercrime Tool ErrTraffic Let Attackers Automate ClickFix Attacks
A new cybercrime tool named ErrTraffic has been identified on underground forums. This tool facilitates attackers in deceiving users into executing malicious software on their devices.
A new cybercrime tool named ErrTraffic has been identified on underground forums. This tool facilitates attackers in deceiving users into executing malicious software on their devices.
ErrTraffic automates ClickFix attacks, which involve generating fake error messages that prompt users to manually execute harmful commands. Unlike traditional methods that covertly download files, ClickFix manipulates users into resolving fabricated issues on websites by executing specific codes.
ErrTraffic is distinguished by its professional design and affordability, enabling attackers with limited skills to conduct attacks across various platforms, including Windows, Android, macOS, and Linux.
The tool was initially detected on Russian-language cybercrime forums in early Dec 2025, with an entity named LenAl advertising it. The complete ErrTraffic package is available for $800 and comprises a control panel and script system for creating realistic fake glitches on compromised websites.
When users visit an infected site, they are presented with distorted text, altered fonts, and visual errors that make the site appear corrupted. A popup window then suggests a fix via a browser update or system font installation.
A new cybercrime tool named ErrTraffic has been identified on underground forums.
ErrTraffic operates through a simple JavaScript injection. Attackers who compromise a website can insert a single line of code that links to their control panel. The script identifies the device and browser used by each visitor, then displays a custom fake error message in the appropriate language.
Users who click the fix button inadvertently copy a PowerShell command to their clipboard and are instructed to execute it, bypassing traditional security software as the action appears legitimate.
Analysis of active ErrTraffic campaigns shows a high effectiveness rate, with conversion rates nearing 60 percent. This means that nearly six out of ten people who encounter the fake error message are deceived into installing malware.
The tool can deliver any payload specified by the attacker, commonly deploying infostealers like Lumma or Vidar for Windows systems, and banking trojans for Android devices. The control panel also features geographic filtering, with blocks for Russia and neighboring countries to evade local law enforcement.
Once a device is infected, attackers can steal login credentials and use them to compromise more websites, perpetuating the attack cycle.
Based on reporting by Cyber Security News.