Published on August 11, 2026
ErrTraffic Combines Compromised WordPress Sites, Blockchain C2 and Rotating Malware Domains
Severity
Medium
Detail
An active ErrTraffic malware-as-a-service (MaaS) campaign is combining compromised WordPress websites, ClickFix social-engineering techniques, Polygon blockchain smart contracts, and frequently changing malware domains to distribute multiple types of Windows malwares. ErrTraffic is marketed as a MaaS framework by a forum user known as “LenAI.” Its main function is a traffic distribution system that directs victims toward payloads while applying filtering mechanisms and rotating its infrastructure.
Unlike conventional malicious JavaScript campaigns that contain hardcoded command-and-control or staging domains, ErrTraffic uses compromised WordPress sites to query Polygon Remote Procedure Call (RPC) endpoints and retrieve infrastructure information stored in smart contracts. This blockchain-based technique, known as EtherHiding, makes the infrastructure more difficult to disrupt.
How?
The attack begins with compromised WordPress websites hosting the ErrTraffic framework. Instead of embedding fixed malicious domains directly into the injected JavaScript, the framework retrieves infrastructure information through Polygon RPC requests.
The initial JavaScript communicates with Polygon infrastructure to obtain updated domains. This allows the operators to change their delivery infrastructure without modifying every compromised website.
Victims are subsequently directed into ClickFix attack flows. These pages attempt to persuade users to execute attacker-provided PowerShell commands while presenting the activity as a solution to browser verification or CAPTCHA-related problems.
One observed delivery pattern downloads a randomly named 7-Zip executable and payload from an API endpoint. The request can contain information such as a token, browser type, referrer, and Cloudflare or reCAPTCHA mode.
Another delivery method directly retrieves a randomly named payload. This architecture allows different affiliates to replace the final malware while maintaining the same initial access and traffic-routing infrastructure.
WatchGuard telemetry associated the ErrTraffic framework with several malware families and payloads, including Vidar, Okobot, LegionLoader, OnionDrop-related malware and BabaDedaLoader.
Impact
The campaign creates a flexible malware delivery infrastructure in which compromised websites provide the initial reach, ClickFix techniques encourage execution, blockchain-based infrastructure conceals changing domains and affiliates can select different malware payloads according to their objectives.
Observed payload activity included multiple forms of defense evasion, persistence, credential-access preparation, browser targeting and system reconnaissance.
For example an Okobot delivery used a ZIP archive containing a legitimate Volume² utility together with a malicious protobuff.dll for DLL sideloading. Subsequent commands modified Microsoft Defender exclusions and settings, established SSH persistence and removed the RunAsPPL registry value, which can weaken LSASS protection and make credential theft easier.
Another malicious MSI installer delivered a Node.js backdoor that used gRPC-over-Tor communications, established NexusConnector Run-key persistence and collected information about disks, the operating system, graphics hardware and installed antivirus products.
Other observed payloads used DLL sideloading, browser process injection, virtualization checks, display-adapter fingerprinting, reflective loading and Windows compiler utilities.
Recommendation
Defenders should monitor suspicious PowerShell download activity particularly commands associated with ClickFix-style execution.
Security teams should also monitor for unexpected Polygon RPC traffic originating from web sessions, as well as the errtraffic_session cookie associated with websites hosting the ErrTraffic framework.
Additional monitoring should focus on:
- DLL sideloading activity.
- Browser processes creating unexpected remote threads.
- Unusual execution of compiler-related binaries.
- Unexpected Microsoft Defender configuration changes.
- Suspicious Run-key or SSH persistence.
- Abnormal traffic to newly rotating payload infrastructure.
Organizations should also pay close attention to compromised WordPress websites and investigate unexpected JavaScript or other modifications that could be used to distribute malicious content.
Conclusion
ErrTraffic demonstrates how a malware delivery framework can combine compromised WordPress infrastructure, ClickFix social engineering, blockchain-based infrastructure retrieval and rotating payload domains into a modular distribution system.
The separation between delivery, infrastructure resolution, and final payload allows attackers and affiliates to change malware and infrastructure while retaining the same delivery architecture. This makes monitoring the complete attack chain important rather than relying on detection of a single malicious domain or file.