Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework

MITRE Techniques

• [T1059.001 ] PowerShell – Used to download, decrypt, and execute the final payload from the ClickFix lure (‘PowerShell command lines for downloading the malicious payload’ / ‘The PowerShell command contains a XORed string which is decrypted and executed’).
• [T1059.003 ] Windows Command Shell – The framework’s ClickFix flow delivers commands that are copied and executed by the victim, including command-line payload execution via staged instructions (‘the command copied to the clipboard’ / ‘download and execute the binary’).
• [T1027 ] Obfuscated Files or Information – ErrTraffic scripts and payloads use Base64, XOR, JavaScript obfuscation, RC4, and encoding to hinder analysis (‘Base64-encoded and XOR-obfuscated’ / ‘RC4 encryption’).
• [T1105 ] Ingress Tool Transfer – Payloads are fetched from remote infrastructure through API calls and downloaded by PowerShell (‘retrieves the ClickFix lure’ / ‘downloading and executing the binary’).
• [T1218.011 ] System Binary Proxy Execution: Rundll32 – The report describes downloaded binaries and loaders executed through staged payload chains, though specific rundll32 use is not explicit in the text; included only if implied by loader-style execution (‘the final payload delivered was identified as HijackLoader’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence is maintained through hourly restoration and multiple layers of auto-redeployment-like mechanisms (‘restored hourly’ / ‘Persistence is maintained through seven distinct layers’).
• [T1566 ] Phishing – ClickFix lures are social-engineering pages that trick users into executing commands (‘display the ClickFix lure to visitors’ / ‘Blue Screen of Death (BSOD) ClickFix lure’).
• [T1071.001 ] Web Protocols – The backdoor and framework communicate with C2 and APIs over HTTP(S), including specific endpoints like /api/index.php and /cf.js (‘API requests to /api/index.php’ / ‘fetch the script embedding the ClickFix lure’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The implant checks security-tool User-Agents and suspends malicious behavior during scans (‘If detected, it suspends all malicious blocks’ / ‘known security tools’).
• [T1078 ] Valid Accounts – WordPress access was obtained using harvested administrator credentials (‘the attacker gained access using valid administrator credentials’).
• [T1505.003 ] Server Software Component: WordPress Plugin – Attackers inserted malicious MU-plugins and theme-file droppers to persist on the site (‘wrote the MU-Plugin to wp-content/mu-plugins/session-manager.php’ / ‘inserting a dropper into the active theme’s functions.php’).