ErrTraffic uses decentralized updates to outpace static blocking

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WatchGuard's report: ErrTraffic uses decentralized infrastructure updates, EtherHiding and ClickFix to keep malware delivery active while evading static blocking.

Why it matters: This matters because MSPs and security teams need controls that survive changing infrastructure, not just reputation-based blocks that disappear as soon as an attacker swaps hosts.

Context

Modern malware distribution now depends less on fixed hosts and more on mechanisms that can refresh the delivery path without breaking the campaign. That shift weakens controls built around a known domain, a known IP, or a single compromised server, because the attacker can replace the resource faster than defenders can curate blocklists.

ErrTraffic is a good example of this operational change. The campaign uses compromised websites, a fake error prompt and a command execution lure to move the victim into the payload chain, while the infrastructure lookup itself is outsourced to a decentralized mechanism rather than a single stable host.

Key questions

Q: How do I detect malicious PowerShell launched through fake repair prompts?

A: Look for users copying and pasting commands into Run, terminal or browser-based prompt flows, then correlate that activity with unusual PowerShell child processes, network fetches and process trees that do not match normal admin behaviour. The key is to detect the execution path, not just the original web page.

Q: Why do static domain blocklists fail against rotating malware infrastructure?

A: Static domain blocklists fail because rotating malware infrastructure changes domains, IP addresses, or hosting providers faster than defenders can update detections. The malware may also use fast-flux DNS, compromised servers, or disposable cloud instances, so the blocklisted indicator goes stale while the command-and-control path stays live. More resilient controls use DNS analytics, behaviour-based detections, URL and certificate correlation, and sinkholing.

Q: How does EtherHiding support malware delivery?

A: EtherHiding is a malware delivery technique that stores payloads or downloader logic in blockchain smart contracts or related decentralised infrastructure. Attackers retrieve the malicious content at runtime, which makes the hosting layer harder to take down and allows the delivery path to change without rebuilding the campaign. Defenders need transaction monitoring, web filtering, script control, and inspection of outbound requests for suspicious retrieval patterns.

Q: What should MSPs do first when a malware campaign keeps changing hosts?

A: MSPs should first map the campaign’s infrastructure patterns, then move to layered detection across DNS, proxy, endpoint, and email telemetry so repeated host changes do not break coverage. Baselines for command-and-control behaviour, certificate reuse, and redirect chains help identify the campaign even when IPs and domains rotate. Centralised threat hunting and rapid block, isolate, and sinkhole actions should follow.

Technical breakdown

How ClickFix turns a fake error into execution

ClickFix is a social engineering pattern that persuades the user to copy and run a command, usually presented as a technical repair step. In this campaign, the lure uses a fabricated error message on a compromised site to create urgency and legitimacy. The important security detail is that the user becomes the execution path, which means traditional perimeter controls may only see a benign-looking page visit before the PowerShell command is run.

Practical implication: Inspect user-executed command patterns and block suspicious script launch chains, not just malicious URLs.

Why EtherHiding changes the value of blocklists

EtherHiding moves the infrastructure lookup into data stored on a public blockchain smart contract, which attackers can update without changing the rest of the infection chain. That means the malware can ask the contract where the next resource lives, then move to a fresh host if the old one is blocked. The control problem is not the blockchain itself, but the attacker ability to use a mutable, distributed lookup layer that is harder to pin to one indicator.

Practical implication: Treat address blocking as temporary containment and pair it with behaviour detection that can survive host rotation.

Why endpoint behaviour matters when payloads change fast

When infrastructure is disposable, file hashes, domains and server reputations lose value quickly. Behavioural detection shifts the focus to what the process does on the endpoint, such as spawning PowerShell, fetching a payload, starting an unauthorized process or installing remote access tooling. That gives defenders a stable detection surface even when the delivery site, download host or command source changes repeatedly.

Practical implication: Anchor response on host telemetry and process lineage so you can isolate the endpoint even when the malware changes location.

Threat narrative

Attacker objective: The objective is to keep delivering malware and maintaining campaign continuity even after defenders block individual hosts or domains.

1. Entry begins when the victim lands on a compromised website that shows a fake error message and creates pressure to run a supposed fix.
2. Credential_harvested is not the main step here, but the campaign gains execution by tricking the user into copying and running a PowerShell command that starts the download chain.
3. Escalation occurs as the malware retrieves updated infrastructure details through EtherHiding and continues the infection from a new resource when the previous one is blocked.
4. Impact is sustained malware delivery and extended campaign lifetime, which keeps the endpoint exposed while defenders chase changing indicators.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static infrastructure blocking is no longer a complete malware containment model. ErrTraffic shows that blocklists still matter, but only as one layer in a larger control stack. When attackers can swap hosts and update delivery points without changing the broader infection chain, the defender's real problem is continuity of malicious function, not the lifespan of a single bad address. Practitioners should treat reputation controls as a short window of suppression, not as a durable stop condition.

ClickFix shifts the security boundary from the network edge to the user action itself. The campaign depends on a fake repair flow that persuades the victim to execute a command locally, which means the decisive moment is not the website visit but the script launch. That creates a governance problem for endpoint telemetry, user execution controls and response playbooks that still assume malware starts with a downloaded file alone. The control gap is command execution visibility, not URL filtering.

EtherHiding creates a mutable infrastructure lookup layer that frustrates conventional takedown logic. By placing the resource locator behind a smart contract, the campaign decouples the infection from a single infrastructure owner or server endpoint. That is the specific failure mode this campaign illustrates: a disposable hosting model with a persistent coordination layer. Security teams should recognise this as a modern delivery pattern where the attack chain survives individual sinkholes, blocks and resets.

Malware operations are becoming resilient systems, not just malicious hosts. That matters because defenders often still organise response around domains, IPs and file samples, while the campaign itself is designed to survive exactly those controls. The named concept here is infrastructure churn resilience: the ability of a campaign to keep operating even as defenders replace or block parts of its delivery path. Practitioners need detection and response models that focus on the campaign behaviour, not only the current infrastructure.

For managed service providers, the operational burden is shifting from indicator curation to control orchestration. MSPs that rely on static feeds will always lag a campaign that can refresh its delivery layer on demand. The better model is layered visibility across network, endpoint and script execution so that one control failure does not equal campaign success. That is what separates tactical blocking from durable service resilience.

What this signals

Infrastructure churn resilience: modern malware campaigns can preserve their delivery logic while replacing the hosts that carry it, which means defenders need controls that target behaviour rather than a single address. That shift raises the value of endpoint execution telemetry and reduces confidence in blocklists as a standalone control.

MSP programmes should expect more campaigns to separate coordination from delivery, using distributed lookups or disposable hosting to extend infection windows. That puts pressure on SOC workflows to tie web, DNS and endpoint signals together before an attacker can refresh the infrastructure again.

For practitioners

• Harden script execution controls Block or constrain high-risk script launch paths such as copied PowerShell commands from user-facing prompts and monitor for suspicious command-line activity.
• Correlate network and endpoint telemetry Use host process lineage alongside DNS, proxy and web logs so a changed host name does not erase the observable chain of execution.
• Treat blocklists as temporary containment Assume domains, IPs and download hosts can be replaced quickly and make sure alerts escalate to behaviour-based detections and isolation actions.
• Add sandboxing before payload reach Detonate unknown files and scripts before they reach production endpoints, especially where user-driven download flows are common.
• Review MSP response playbooks for campaign churn Validate that client response procedures still work when the same campaign shifts infrastructure repeatedly across hours or days.

Key takeaways

• ErrTraffic shows how malware campaigns can survive rapid infrastructure swaps without changing their underlying infection chain.
• The operational weakness is dependence on static indicators, because a blocked host can be replaced before the response catches up.
• Behaviour-based endpoint detection and layered network controls are the practical way to limit campaigns that keep moving infrastructure.

Related NHI Mgmt Group resources: Malware Guide · Threat Actors Targeting SaaS and Cloud Identity Guide · How to find service accounts with Domain Admin rights

Key terms

• ErrTraffic: ErrTraffic is a malware distribution campaign that uses compromised websites, lure pages and rotating infrastructure to keep infections active. The name refers to the observed campaign rather than a single payload, and its significance is the way delivery and infrastructure management are separated from the core infection logic.
• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• EtherHiding: EtherHiding is a malware delivery technique that stores malicious payloads or payload references in a blockchain smart contract. The attacker uses the chain as a durable retrieval source, which makes takedown difficult and allows payload access without maintaining a traditional server.
• Blocklist: A blocklist is a maintained list of IP addresses or domains associated with spam, phishing, malware, or other abuse. Security and email systems consult it to reject or downgrade traffic, so a listing can affect delivery and partner trust even when the underlying issue is temporary.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management and workload identity for practitioners building stronger access control programmes. It helps identity and security teams connect governance decisions to the controls that stop misuse of credentials and delegated access.