ErrTraffic MaaS Uses Fake reCAPTCHA and Cloudflare Turnstile Lures to Execute PowerShell Commands

Key Takeaways

• ErrTraffic is a growing Malware-as-a-Service (MaaS) operation that leverages fake reCAPTCHA and Cloudflare Turnstile screens to trick users into executing malicious PowerShell commands.
• The attack chain involves compromised WordPress sites injecting a JavaScript payload that resolves command-and-control (C2) infrastructure from the Polygon blockchain using EtherHiding.
• Two distinct clusters, “Analytics” and “Beer,” distribute various malware families, including infostealers and remote access tools, with a PHP backdoor providing persistent access and data skimming capabilities on infected WordPress sites.
• The MaaS offering, sold by “LenAI” on cybercrime forums and Telegram, has seen significant price increases, reflecting its effectiveness and demand among threat actors.

ErrTraffic MaaS Leverages Deceptive CAPTCHA Lures to Inject PowerShell Commands

A sophisticated new Malware-as-a-Service (MaaS) framework, identified as ErrTraffic, is rapidly gaining traction in cybercrime circles. This operation employs highly convincing fake reCAPTCHA and Cloudflare Turnstile verification pages to mislead users into unknowingly executing malicious PowerShell commands on their systems. The core deception lies in tricking victims into performing what appears to be a routine security check, while in the background, their machines are being compromised.

First observed in late 2025, ErrTraffic has evolved into a full-fledged MaaS, enabling various cybercriminals to lease the tool and launch their own targeted attacks. This framework is built upon the “ClickFix” social engineering technique, as detailed in a report by analysts at Sekoia shared with Cyber Security News (CSN).

How ErrTraffic Operates

The attack initiates when an unsuspecting user visits a legitimate but compromised WordPress website. A malicious JavaScript snippet is covertly injected into these sites. This script presents a fabricated verification screen, meticulously designed to resemble authentic Google reCAPTCHA or Cloudflare Turnstile prompts. The victim is then instructed to press a specific keyboard shortcut. Unbeknownst to them, this action triggers the execution of a PowerShell command that the malicious background script has already silently loaded into their clipboard.

A key innovation in ErrTraffic’s design is its use of EtherHiding, a technique that conceals its command-and-control (C2) infrastructure within Polygon blockchain smart contracts. This method significantly hinders detection and blocking efforts by traditional security tools, as the attackers can frequently rotate their C2 infrastructure without needing to redeploy code on the already compromised websites.

Infection Chain and Payload Delivery

The infection chain begins with a Base64 and XOR-encoded JavaScript payload embedded in a compromised WordPress page. Upon loading, this script queries the Polygon blockchain to retrieve the current C2 server address. This dynamic C2 resolution allows attackers to change servers daily without altering the thousands of infected websites hosting their initial code.

Once the C2 address is resolved, the script fetches the ClickFix lure via API endpoints like /cf.js or /api/css.js, depending on the specific cluster involved. This lure renders the deceptive CAPTCHA or Cloudflare Turnstile screen, instructing the user to perform a keyboard shortcut for verification. Executing this shortcut then triggers a PowerShell script, which proceeds to download and execute the final malicious payload. These payloads vary, including information stealers like Vidar, Stealc, Remus, and Salat, as well as loaders such as SmokeLoader, and various remote access tools.

Beyond compromised WordPress sites, ErrTraffic operators also create malicious websites impersonating popular AI platforms, such as “Google Antigravity” and “ChatGPT,” to broaden their reach. These fake sites deliver the same ClickFix lure, targeting users searching for AI software. These campaigns are believed to be propagated through malvertising, extending the threat beyond the WordPress ecosystem.

Backdoor Deployment and Persistent Access

For persistent access, attackers, after gaining unauthorized entry to a WordPress site using stolen administrator credentials, deploy a PHP backdoor named session-manager.php. This file is placed in the mu-plugins directory, ensuring it is automatically loaded by WordPress without requiring manual activation.

This backdoor offers multiple functionalities: it harvests login credentials by intercepting authentication requests, skims WooCommerce order data in a server-side Magecart-style attack, and provides a webshell for remote code execution. To evade detection, the backdoor actively monitors incoming User-Agent strings for signatures associated with security tools like Wordfence and Nikto. If such tools are detected, the malicious activity is temporarily paused for thirty minutes.

What You Should Do

• Enable PowerShell ScriptBlock Logging: Configure PowerShell to log script block activity to detect XOR-decoded commands associated with ErrTraffic.
• Monitor Blockchain RPC Connections: Look for suspicious patterns where blockchain RPC connections are immediately followed by PowerShell execution, as these are strong indicators of compromise.
• Regularly Audit WordPress Installations: Conduct frequent audits of your WordPress mu-plugins directories for any unauthorized or unfamiliar PHP files like session-manager.php.
• Rotate WordPress Credentials: Implement a strict policy for regular rotation of all WordPress administrator and database credentials.
• Educate Users on Social Engineering: Train users to be wary of unexpected CAPTCHA or verification prompts, especially those requiring unusual keyboard shortcuts. Verify the legitimacy of such prompts directly from the service provider if in doubt.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to suspicious PowerShell activity and unauthorized script execution.
• Use a Robust Web Application Firewall (WAF): Deploy a WAF to help protect WordPress sites from injection attacks that could lead to initial compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.