ErrTraffic Combines WordPress Hacks, Blockchain C2 and Rotating Malware Domains in One Delivery Network

An active ErrTraffic malware-as-a-service campaign that combines compromised WordPress sites, ClickFix lures, Polygon blockchain smart contracts and rapidly rotating payload domains to distribute a broad set of Windows malware.

ErrTraffic is marketed as a MaaS framework by a forum user known as “LenAI.” Its core feature is a traffic distribution system that routes victims to payloads while applying filtering logic and infrastructure rotation.

Unlike conventional malicious JavaScript campaigns, ErrTraffic does not hardcode its command-and-control or staging domains in the injected web content.

Instead, compromised WordPress sites query Polygon Remote Procedure Call endpoints to retrieve infrastructure data from smart contracts.

This blockchain-backed technique, known as EtherHiding, makes disruption considerably harder.

Smart contracts can store or resolve malicious configuration data while public blockchain infrastructure provides a resilient retrieval mechanism.

In this campaign, the initial JavaScript fetches data through Polygon RPC, allowing operators to update domains without revising every compromised site.

A Set-Cookie value containing errtraffic_session= is a useful hunting indicator for websites hosting the framework. Sekoia previously published related infrastructure in its ErrTraffic IOC collection.

Victims are pushed into ClickFix flows, which manipulate users into executing attacker-supplied PowerShell commands under the premise of resolving browser verification or CAPTCHA errors.

One observed command pattern retrieves a randomly named 7-Zip binary and payload from an API endpoint using parameters such as token, src=cloudflare, browser type, referrer, and a Cloudflare or reCAPTCHA mode.

The activity, analyzed by WatchGuard researcher Euler Neto, illustrates how traffic-distribution systems are becoming modular delivery platforms rather than simple redirect infrastructure.

A second pattern directly downloads a randomly named payload. The design lets affiliates alter final-stage malware while retaining the same initial-access and traffic-routing architecture.

ErrTraffic Combines WordPress Hacks

WatchGuard telemetry linked the framework to Vidar, Okobot, LegionLoader, OnionDrop-related payloads and BabaDedaLoader. Vidar samples used multiple C2 mechanisms, including Telegram, Steam profiles and compromised web infrastructure.

One variant created remote threads in Chrome, potentially attempting to access browser data protected by Chrome Application-Bound Encryption.

Another Go-based variant targeted Chrome and Edge, including activity involving Adobe’s Create PDF browser extension associated with CVE-2026-48294, a UXSS vulnerability affecting vulnerable extension versions.

Okobot delivery showed a more overt defense-evasion path. Attackers distributed a ZIP archive containing the legitimate Volume² utility alongside a malicious protobuff.dll for DLL sideloading.

Subsequent commands added Microsoft Defender exclusions, altered Defender notification and sample-submission settings, configured SSH persistence, and deleted the RunAsPPL registry value.

Removing that LSASS protection can make credential theft easier. The malware later contacted infrastructure previously associated with Okobot research from Kaspersky.

Other payloads broaden the operational picture. A malicious MSI installer deployed a Node.js backdoor that established gRPC-over-Tor communications, created NexusConnector Run-key persistence and profiled disks, operating-system details, graphics hardware and installed antivirus products.

OnionDrop variants used DLL sideloading, browser process injection, virtualization checks and display-adapter fingerprinting, while one Go sample reached LegionLoader-associated infrastructure and used reflective loading.

These behaviors align with prior Cyderes OnionDrop analysis.

BabaDedaLoader activity added a living-off-the-land angle through csc.exe and cvtres.exe, binaries capable of compiling and converting resources during local .NET loader execution.

The resulting chain contacted infrastructure documented in a Morphisec BabaDedaLoader report.

ErrTraffic’s significance lies in its separation of delivery, resolution and payload layers. Compromised sites supply reach, ClickFix provides execution, Polygon contracts obscure infrastructure, and affiliates select malware according to their objectives.

Defenders should monitor suspicious PowerShell download syntax, unexpected Polygon RPC traffic from web sessions, errtraffic_session cookies, DLL sideloading chains, browser remote-thread creation and anomalous use of compiler binaries.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide