Sekoia threat researchers recently analyzed a new campaign leveraging the ErrTraffic ClickFix malware distribution framework and identified several network IoCs from which we extracted 71 domains. They believed LenAI who has been gaining notoriety as a MaaS operator in the Dark Web is behind the recent spate of attacks.

The two clusters Sekoia analyzed zoomed in on WordPress servers, had a built-in TDS function, concealed their C&C infrastructure within the blockchain, and utilized fake AI tools (e.g., Google Antigravity and ChatGPT) as lures. Even if MaaS distributor LenAI was implicated, the researchers surmised that the clusters they studied (i.e., Analytics and Beer) were launched by different but unnamed threat actors. Note that LenAI was also behind the Aeternum C&C botnet publicized in February this year, among other threats.

Our own DNS deep dive into the ErrTraffic network IoCs led to these discoveries:

• Eight unique client IP addresses that communicated with six distinct domain IoCs
• Two domain IoCs that appeared in two typosquatting groups with 3—5 members each
• Four domain IoCs that were likely registered with malicious intent
• 12 email-connected domains
• 16 IP addresses, 12 of which were confirmed malicious
• 156 IP-connected domains, 44 of which were confirmed malicious
• 1,079 string-connected domains

A sample of the additional artifacts obtained from our analysis is available for download from our website.

Deep Diving into the ErrTraffic Domain IoCs

We began our investigation by ensuring none of the 71 domain IoCs were owned by legitimate entities aided by the WhoisXML API MCP Server.

Next, we looked at sample network traffic data from the IASC and discovered that eight unique client IP addresses under four distinct ASNs communicated with six of the domain IoCs via 45 DNS queries between 20 April and 15 June 2026.

We then queried the domain IoCs on Typosquatting API and learned that two of them appeared in two typosquatting groups. The IoC finework[.]top was bulk-registered with four look-alike domains, three of which were created on 22 March 2026. Note that one of its look-alikes did not have a creation date on record. The domain sandman[.]bond, meanwhile, was bulk-registered with two look-alikes between 26 and 27 April 2026.

Next, we discovered that four of the domain IoCs appeared on the First Watch Malicious Domains Data Feed. They were likely registered with malicious intent 118—127 days before they were dubbed as IoCs. The domain cloud-safe[.]click, for instance, was registered on 9 February 2026, 127 days before the Sekoia report’s publication on 16 June 2026.

We then queried the domain IoCs on WHOIS API, completed missing data points with the help of Domain Info API, and found out that:

• They were all created in 2026, hinting at the threat actors’ preference for using NRDs in their campaigns.
• They were administered by five registrars.

  

• While three domains did not have registrant countries on record, the remaining 68 were registered in three countries.

  

Next, we queried the domain IoCs on DNS Chronicle API and learned that 70 recorded 566 historical domain-to-IP resolutions over time. Here are more details for five examples.

All 70 domains with historical results continue to post resolutions in 2026.

New ErrTraffic Artifacts Brought to Light

After all that, we started our hunt for new ErrTraffic artifacts.

First, we queried the domain IoCs on WHOIS History API and discovered that four had four unique email addresses in their historical records. Further scrutiny revealed that two were public email addresses.

Reverse WHOIS API queries for the public email addresses led to the discovery of 12 unique email-connected domains after those already identified as IoCs were filtered out.

Next, we queried the domain IoCs on DNS Lookup API and learned that 30 resolved to 16 unique IP addresses.

Threat Intelligence API queries for the IP addresses showed that 12 have already been weaponized for various malicious campaigns.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.