Reported by 2 outlets

Timeline

1. original reporting

   ErrTraffic MaaS Stores Malware Delivery Infrastructure in Polygon Smart Contracts

   cyberpress.org · 64d ago · August 11th, 2026

   WatchGuard Threat Lab documented ErrTraffic, a malware-as-a-service operation that hides its delivery infrastructure inside Polygon blockchain smart contracts rather than embedding C2 addresses in injected website code, letting operators rotate infrastructure without touching the compromised sites hosting the initial lure. The chain combines ClickFix social engineering with blockchain-based EtherHiding and dynamic payload delivery, pushing Vidar, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, plus DLL side-loading variants. Detection and takedown become significantly harder when the delivery layer lives on-chain.

2. update from cyberpress.org

   ErrTraffic MaaS Hides Malware Infrastructure in Polygon Blockchain Smart Contracts

   cyberpress.org · 63d ago · August 11th, 2026

   According to research by WatchGuard Threat Lab member Euler Neto, ErrTraffic operators use Polygon blockchain smart contracts to store or resolve malicious infrastructure rather than placing command-and-control (C2) addresses directly inside injected website code. This approach allows attackers to update their delivery infrastructure without changing the compromised sites hosting the initial lure. The campaign has delivered threats including Vidar, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader. WatchGuard telemetry also identified additional payload variants, DLL side-loading activity, browser-targeting behavior, and techniques designed to weaken endpoint defenses. ErrTraffic was reportedly promoted by a forum user known as “LenAI.” The framework includes a traffic distribution system (TDS), enabling affiliates to filter visitors, route selected targets to payloads, and track delivery activity. The use of MaaS lowers the barrier for cybercriminals who want to launch malware campaigns without building their own infrastructure. ErrTraffic Conceals Infrastructure on Polygon The attack begins when a victim visits a legitimate WordPress website that has been compromised and injected with malicious JavaScript. Investigators noted that sites hosting ErrTraffic can be identified through the errtraffic_session=

3. update from gbhackers.com

   ErrTraffic Combines WordPress Hacks, Blockchain C2 and Rotating Malware Domains in One Delivery Network

   gbhackers.com · 63d ago · August 11th, 2026

   An active ErrTraffic malware-as-a-service campaign that combines compromised WordPress sites, ClickFix lures, Polygon blockchain smart contracts and rapidly rotating payload domains to distribute a broad set of Windows malware. ErrTraffic is marketed as a MaaS framework by a forum user known as “LenAI.” Its core feature is a traffic distribution system that routes victims to […] The post ErrTraffic Combines WordPress Hacks, Blockchain C2 and Rotating Malware Domains in One Delivery Network appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .