ErrTraffic
ErrTraffic is a cybercriminal threat cluster/service identified in the provided reporting as operating a ClickFix-as-a-Service model. Proofpoint-linked reporting described campaigns as likely conducted either by the ErrTraffic service itself or by an affiliate of ErrTraffic. The service provides ready-made infrastructure for ClickFix attacks and allows customers to deliver malware of their choice. ErrTraffic is also explicitly listed among threat clusters beyond the TA569 ecosystem that use web injects. In the cited Gizmodo incident, activity attributed to an ErrTraffic affiliate used fake CAPTCHA/ClickFix prompts delivered via a malicious script injected into a compromised website account. The prompts were tailored by operating system and attempted to trick users into manually executing terminal or PowerShell commands. On Windows, the campaign attempted to install NetSupport RAT; a separate macOS payload was prepared but appeared ineffective because it was packaged in a password-protected ZIP archive. The content does not attribute ErrTraffic to any nation state, and no additional aliases or sub-groups are provided beyond the name ErrTraffic.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Likely operated the ClickFix campaign against Gizmodo readers, providing ClickFix-as-a-Service infrastructure to distribute malware via fake CAPTCHA prompts.
A ClickFix-as-a-service operation whose affiliates deliver malware via fake CAPTCHA-style prompts that trick users into executing malicious commands.
Threat cluster identified as using web inject campaigns beyond the TA569 ecosystem.
Threat cluster involved in web-inject campaigns using compromised websites and fake update style delivery.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.