ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites

Sekoia documents ErrTraffic, a ClickFix distribution framework sold as MaaS (advertised by actor “LenAI”) that injects malicious JavaScript into compromised WordPress and fake AI sites to trick visitors into executing PowerShell. The toolkit uses an EtherHiding Polygon smart contract for blockchain-based C2 rotation, serves geo/OS-filtered payloads (Vidar, Stealc, Remus, Salat, SmokeLoader, DanaBot, HijackLoader), employs MU-plugin backdoors and credential-stuffing access, and is offered as a rental/source model with active exploitation observed across many sites; defenders should enable PowerShell ScriptBlock logging, monitor blockchain RPC-to-PowerShell patterns, audit mu-plugins, and enforce MFA.