The commercialization of ClickFix phishing panels like ErrTraffic enables threat actors to bypass traditional security controls by tricking users into executing obfuscated PowerShell commands. This analysis breaks down the attack chain and outlines defense strategies.
Infiltrating enterprise networks through the compromise of end-user devices, the widespread sale of automated social engineering panels poses a severe operational threat to corporate infrastructure. The commercial availability of these frameworks, particularly those implementing the highly deceptive ClickFix social engineering template, directly enables low-skilled adversaries to execute complex initial access operations. By tricking legitimate users into executing malicious code, these campaigns bypass browser-based sandboxes and traditional security controls, leading to the immediate exposure of sensitive corporate credentials, session cookies, and intellectual property. Organizations can evaluate their exposure to these types of exploits by leveraging advanced Vulnerability Assessments to secure their outward-facing web infrastructure.
The cybercrime underground has shifted heavily toward user-assisted execution methods, commoditizing these techniques via specialized Malware-as-a-Service (MaaS) frameworks. A prominent example of this trend is the ErrTraffic distribution panel (specifically versions v2 through v4), which is actively advertised on top-tier Russian-language forums like Exploit.IN and Telegram. Developed and sold by a threat actor operating under the handle LenAI, the platform is structured around a commercial subscription model, priced between 300 USD and 380 USD per month, with full unencrypted source code retailing for up to 4,500 USD.
Unlike traditional phishing campaigns that rely on direct attachment downloads or exploit kits, the ClickFix administrative panel automates the deployment of highly persuasive fake error templates. The panel features robust control mechanisms, including administrative interfaces, file management capabilities, granular download statistics, and customizable verification workflows. Affiliates utilize these interfaces to monitor victim interaction rates and manage the distribution of diverse malware payloads, turning compromised public websites into dynamic traffic distribution systems.
The operational framework of an ErrTraffic ClickFix campaign is characterized by a sophisticated multi-stage attack chain that transitions from automated web server exploitation to highly targeted end-user social engineering.
Exploitation of CVE-2020-25213 (WP File Manager) or CVE-2026-26980 (Ghost CMS) to inject session-manager.php backdoor.
JavaScript uses geolocation APIs (ipwho.is) to profile users, filtering out CIS targets.
Page text changes to Zalgo characters and displays fake error overlay asking to 'Fix Glitch'.
User click on modal button force-writes highly obfuscated PowerShell commands to the clipboard.
User is socially engineered to open Windows Run dialog (Win+R) and paste (Ctrl+V) the shellcode.
PowerShell script queries Polygon blockchain (0x08207B...) to decode C2 address, loading infostealers.
detection: selection_parent: ParentProcessName|endswith: - '\\explorer.exe' - '\\cmd.exe' selection_process: Image|endswith: '\\powershell.exe' selection_cmdline: CommandLine|contains: - '.reverse()' - 'replace' - 'gzip' condition: selection_parent and selection_process and selection_cmdlineIf your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
July 5, 2026
A sophisticated Phishing-as-a-Service platform called ARToken has emerged, targeting Microsoft 365 users. By weaponizing OAuth 2.0 Device Authorization Grants, the platform bypasses MFA to capture persistent access tokens, posing a critical security threat to enterprise tenants across the GCC region.
A sophisticated Adversary-in-the-Middle (AiTM) phishing framework named Blacksite, integrated with the Cloaked.gg bot evasion engine, has emerged on cybercriminal forums. Exploiting standard session validation, this service intercepts credentials and session tokens to orchestrate stealthy corporate account takeovers.
June 30, 2026
A deep dive into the Bluekit and SnagX Phishing-as-a-Service platforms, analyzing how threat actors utilize Adversary-in-the-Middle reverse proxies to bypass multi-factor authentication and execute automated account takeovers targeting e-commerce credentials.
Defending against ClickFix style attacks requires a coordinated strategy that addresses both web server integrity and endpoint process visibility.
Security teams should implement specific endpoint detection rules to flag anomalous PowerShell executions. Monitor process creation events where powershell.exe is spawned by parent processes like explorer.exe or cmd.exe, particularly when the command line includes indicators of heavily obfuscated strings or runtime manipulation:
ProcessName: powershell.exe
ParentProcessName: explorer.exe
CommandLine: * .reverse()* OR *replace* OR *gzip*Additionally, security operations centers should monitor Windows Event Logs, specifically Event ID 4104 (Script Block Logging), to inspect the raw contents of executed PowerShell blocks. Look for unusual calls to WebClient or Invoke-WebRequest containing hexadecimal strings or references to public blockchain gateways.
Defeating the ClickFix threat vector requires addressing both the software vulnerabilities that allow attacker deployment and the user behaviors that permit execution. Organizations should proactively implement continuous validation of their external network perimeters. Utilizing specialized defensive strategies, such as Penetration Testing, allows enterprises to identify and remediate vulnerable web applications before threat actors can exploit them to host malicious redirection scripts.
For organizations concerned about credential theft resulting from these campaigns, prompt detection of compromised data is critical. Free domain exposure scan: Use FemtoSec's Dark Web Scanner to check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain. Implementing continuous threat monitoring, such as Dark Web Monitoring, ensures that any leaked data is identified and mitigated before it can be used for unauthorized network access.
Before launching a campaign, affiliates must establish a network of compromised web servers to host the redirection scripts and landing pages. Attackers systematically target popular Content Management Systems (CMS), specifically WordPress and Ghost CMS, employing a mix of automated credential stuffing and known software vulnerabilities:
Vulnerability Exploitation: Attackers actively exploit CVE-2020-25213, a critical remote code execution flaw in the WordPress File Manager plugin, to drop backdoor shells onto target hosts. They also target CVE-2026-26980, an unauthenticated SQL injection vulnerability in Ghost CMS, allowing them to extract administrative database secrets and API keys directly.
Backdoor Injection: Once administrative access is achieved, a Base64-encoded loader is injected into the active theme's functions.php file. This script dynamically drops a persistent must-use PHP plugin (commonly named session-manager.php) into the /wp-content/mu-plugins/ directory. This plugin operates silently as a web shell, WooCommerce data skimmer, and dynamic script injector.
When an unsuspecting visitor accesses a compromised page, the injected ErrTraffic JavaScript initiates a silent profiling sequence. The script queries public geolocation APIs, such as ipwho.is, to identify the visitor's origin. To evade local law enforcement and focus on high-value targets, the panel explicitly filters out visitors originating from Commonwealth of Independent States (CIS) countries.
If the profiling criteria are met, the script dynamically alters the webpage's Document Object Model (DOM). It applies custom CSS distortions and translates standard web fonts into scrambled Zalgo characters. This visual disruption creates the convincing illusion that the user's browser or operating system has encountered a critical font rendering error or security exception. A modal pop-up then appears, prompting the user to complete a verification step to fix the rendering issue.
The core innovation of the ClickFix technique lies in its exploitation of user behavior rather than software flaws. When the victim clicks the Fix or Verify button within the modal interface, the underlying JavaScript immediately executes a clipboard hijack. It writes a highly obfuscated PowerShell command sequence directly to the victim's local system clipboard, bypassing standard browser security boundaries that restrict direct file writes to disk.
The modal interface then displays step-by-step instructions guiding the victim to execute the pasted code manually. This sequence relies entirely on user-assisted execution (MITRE ATT&CK T1204.004):
The user is instructed to press the Windows Key + R shortcut to open the native Windows Run dialog box.
The user is prompted to press Ctrl + V to paste the contents of the hijacked clipboard into the dialog box.
The user presses Enter, executing the highly obfuscated command string directly via the local shell interpreter.
Upon execution, the PowerShell command initiates the final phase of the attack. In modern ErrTraffic v3 and v4 panels, the command utilizes a technique known as EtherHiding. Instead of querying a static command and control (C2) server, the PowerShell script sends a query to public Polygon blockchain smart contracts (such as 0x08207B087F61d7e95E441E15fd6d403) acting as Dead Drop Resolvers (DDR). The script decodes the transaction data to retrieve the active C2 IP address, creating highly resilient infrastructure that cannot be easily taken down.
Once the C2 is resolved, the PowerShell process downloads and executes the primary malware payloads in-memory. The typical payloads distributed by ErrTraffic affiliates include leading information stealers such as Vidar, Stealc, Lumma Stealer, and Danabot, alongside Remote Access Trojans like SmartRAT. These utilities rapidly harvest stored browser credentials, session tokens, and financial data, transmitting them back to the attacker's administrative dashboard.
Organizations hosting WordPress or Ghost CMS instances must establish rigorous file integrity monitoring (FIM). Focus on auditing the /wp-content/mu-plugins/ and /wp-content/themes/ directories. Since must-use plugins are loaded automatically by WordPress and do not appear in the standard admin dashboard, defenders must inspect these files directly via secure shell access or server-level file managers to locate malicious stubs such as session-manager.php.
In the event of a suspected or confirmed compromise, incident response teams should execute the following containment procedures:
Isolate Affected Endpoints: Disconnect any workstation where a ClickFix command execution is suspected to halt outbound credential exfiltration and prevent lateral movement.
Cleanse Web Infrastructure: Purge any unrecognized PHP files from the must-use plugins directory and restore functions.php from a verified secure backup. Upgrade Ghost CMS to versions past 6.19.0 to patch vulnerability CVE-2026-26980.
Invalidate Active Sessions: Rotate all administrative, database, and user credentials across the enterprise, as information stealers target active browser session cookies that bypass multi-factor authentication (MFA).