Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework

This report analyzes the ErrTraffic ClickFix ecosystem: a Malware-as-a-Service JavaScript framework injected into compromised WordPress sites and attacker-controlled landing pages that uses blockchain-based EtherHiding DDR to resolve C2s, supports affiliate smart-contract separation ("Beer" cluster) and a single-operator deployment ("Analytics" cluster), and distributes infostealers, loaders and RATs while employing robust persistence, credential harvesting, and malvertising campaigns impersonating AI platforms.