ErrTraffic Malware Campaign: ClickFix and EtherHiding

WatchGuard Threat Lab observed an active ErrTraffic MaaS campaign that compromises WordPress sites and uses ClickFix lures plus Polygon-based EtherHiding to dynamically resolve and conceal C2 infrastructure; the operation distributes multiple malware families (Vidar, Okobot, LegionLoader, OnionDrop variants, BabaDedaLoader) using techniques including DLL side-loading, process injection, LOLBINs, PowerShell download chains, and Tor/gRPC backdoors, and the report provides telemetry, PowerShell patterns, domains, and behavioral indicators for detection and mitigation.