Sekoia.io#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework.
ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures.
Our forensic analysis of compromised WordPress servers helped us to cluster ErrTraffic and map affiliates' TTPs and backdoors.
We notably identified two distinct clusters: "Analytics" operated by a single threat actor, and "Beer" likely operated by LenAI for affiliates.
