Top Tweets for #errTraffic
eSentire TRU flagged ErrTraffic ClickFix campaigns in July 2026 delivering Cruciferra, using a signed vulnerable driver to kill AV/EDR from the kernel and deploy Remus via malicious PowerShell. #Cruciferra #ErrTraffic #Remus
https://t.co/U0MP4VLWcG
As promised, we've published our analysis of #Cruciferra - an EDR/AV-killing malware loader delivered via #ErrTraffic-generated #ClickFix campaigns. The loader heavily relies on DLL side-loading to bypass SmartScreen - a majority of targeted apps are developer toolchain-based. Full target list and analysis below!
https://t.co/QHUHchJ2IZ
DLL side-load targets:
https://t.co/FJum3AjR9l
We're tracking a new EDR killer using a #BYOVD driver that isn't in Microsoft's block lists / #LOLDrivers and enumerates 140+ security products, including: Crowdstrike, SentinelOne, Microsoft Defender / Sentinel, Carbon Black, Cybereason, Cylance, Symantec, Sophos, FortiEDR, Elastic, Kaspersky, ESET, Avast / AVG, Bitdefender, McAfee / Trellix, Malwarebytes, Webroot, Trend Micro, Avira, Dr. Web, F-Protect / F-Secure, G-Data, Panda Security, and more.
All credits to @jgajek for finding it in the wild π₯
It only activates if the payload being loaded contains ScreenConnect-related strings, uses IOCTL control code 0x2205c0, and passes each security product PID to terminate via input buffer to the driver via DeviceIOControl, which terminates the specified PID via ZwTerminateProcess.
BYOVD: https://t.co/qqhDFhFKiq
Blog coming soon on the loader, after Defcon of course!
I had the pleasure of digging into some errTraffic v4 activity with @thehappydinoa and @SeraphimDomain this week in the @censysio dataset.
Here is a quick update on what we found.
π§΅πππ
#CENSYSARC #ThreatIntel #IOCs #errTraffic #etherhiding #webinjects
Tracing a live #ClickFix chain via #EtherHiding: lure page to Polygon smart contract to stager domain π #ErrTraffic https://t.co/JImYo6mJMT
ErrTraffic malware powers ClickFix attacks on hacked WordPress sites, using EtherHiding on the blockchain to hide its C2 and spread infostealers.
#ErrTraffic #ClickFix #EtherHiding #MaaS #WordPressSecurity #Infostealer #Malware
https://t.co/wwFtdO4lMh
So for those interested, the "scam" was an #ErrTraffic affil that got their inject on the site. It served NetSupport RAT to Win users and another (possibly broken) payload to mac users. If you did follow any of the fake #ClickFix captcha your computer might be infected. >
We identified and resolved a security incident on our site earlier today. A compromised account was exploited to inject a malicious script, briefly exposing users to scam content. The site was taken offline immediately, the script removed, and the account secured.
We're back up. If you notice anything unusual, reach out.
@eastsidemccarty @Gizmodo It's not from ads, some #ErrTraffic affiliate has compromised them. Inject is in main response.
@DanielStitzel @Gizmodo Yes, compromised by some #ErrTraffic #ClickFix affiliate. Inject is in main response
We published an in-depth analysis on the #ErrTraffic framework, detailing two specific clusters ("Beer" and "Analytics"), campaigns compromising WordPress sites to deploy this malicious #ClickFix framework, as well as others impersonating AI platforms
β¬οΈ
https://t.co/c6seTfiLhi
#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework.
ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures.
https://t.co/Vlntn1suGw
#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework.
ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures.
https://t.co/Vlntn1suGw
Last Seen Hashtags on Sotwe
animalportrait
Seen from Netherlands
θι£
Seen from Japan
omegle
Seen from Canada
δΈθ’ζ―η
Seen from Germany
cumshot
Seen from Turkey
omegle or #nolimit() +filter:native_video
Seen from Thailand
ι’ιζ²»δΌζΏι€¨
Seen from United States
bottomjungkook
Seen from Canada
Ω
Ϋ_Ψ’ΫΩ
_ΪΩΩ
Seen from Saudi Arabia
moldovapresident
Seen from Netherlands
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
113.7M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.6M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.7M followers
KATY PERRY
@katyperry
89.6M followers
Taylor Swift
@taylorswift13
83.5M followers
Lady Gaga
@ladygaga
75M followers
Virat Kohli
@imvkohli
72.7M followers
Kim Kardashian
@kimkardashian
70.7M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.7M followers
Bill Gates
@billgates
64.9M followers
Selena Gomez
@selenagomez
62.7M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers