We published an in-depth analysis on the #ErrTraffic framework, detailing two specific clusters ("Beer" and "Analytics"), campaigns compromising WordPress sites to deploy this malicious #ClickFix framework, as well as others impersonating AI platforms

Since that report was written, the operator "LenAI" has released ErrTraffic v4.

We shared some IoCs on our Community GitHub, and and I can share the latest ones, feel free to reach out!

https://github.com/SEKOIA-IO/Community/tree/main/IOCs/errtraffic

https://infosec.exchange/@sekoia_io/116758846525821124

Part 2 of our #EvilTokens in-depth analysis is out!

This blog post details the AI-augmented features significantly facilitating #BEC fraud.

I believe that this AI-augmented post-compromise tooling represent a genuine breakthrough in the #PhaaS ecosystem.

https://blog.sekoia.io/eviltokens-an-ai-augmented-phishing-as-a-service-for-automating-bec-fraud-part-2/

In early March 2026, we uncovered #EvilTokens, a new #PhaaS offering device code phishing pages and AI-driven features to automate and scale BEC workflows.

Part 1 of our analysis provides a technical analysis of the EvilTokens kit ⬇️

https://blog.sekoia.io/new-widespread-eviltokens-kit-device-code-phishing-as-a-service-part-1/

Rapidly adopted by cybercriminals, we already observed multiple EvilTokens cases in @sekoia_io 's telemetry, and hunted various attachments that delivered its pages worldwide.

Part 2 will focus on the AI-augmented pipeline that significantly facilitates and scales BEC fraud.

Our latest TDR report on the #IClickFix framework:

📊 3,800+ WordPress sites compromised worldwide
⚙️ Multi-stage JavaScript loader
🚦 Abusing YOURLS as TDS
🖱️ Fake Cloudflare CAPTCHA and #ClickFix lure
🦠 #NetSupport RAT payload

https://infosec.exchange/@sekoia_io/115977607660963600

Open directory at 104.168.81.]229/BJ/ containing phishing pages for Zimbra, Outlook, Adobe, and various Chinese services

104.168.81.]229

microsoftstorage.duckdns[.]org
outllook.duckdns[.]org
outlookspace.duckdns[.]org
patnerrshipp.duckdns[.]org
spaceoptimize.duckdns[.]org
spaceup.duckdns[.]org
spaceupstorage.duckdns[.]org
webmaii.duckdns[.]org
webmailstorage.duckdns[.]org
webmil.duckdns[.]org
zimbrastorage.duckdns[.]org
zirmbra.duckdns[.]org
zlmbrastorage.duckdns[.]org
spaceupzimbra.chickenkiller[.]com
...

Outlook and Zimbra phishing pages are distributed via email using malicious SVG files that contain obfuscated JavaScript (common phishing TTP nowadays), e.g.

ec7a3247bc86636c6b08bef9a1568b63c289a2d72464c9adebcf16ccfc2ce0f3 > zimbrastorage.duckdns.]org/BJ/zimbra/