Campaign record
ErrTraffic BW Panel via Cloudflare Zaraz
A tag-manager action on a legitimate site loads a panel choosing one of nine fake prompts
- Status as last assessed
- Active
- First seen
- Unrecorded
- Last seen
- Unrecorded
- Indicators
- 4
- Sources
- 1
- Targets
- Windows, macOS
- Fake browser verification challenge
- Fake CAPTCHA verification
- Compromised WordPress site
- ErrTraffic BW Panel lure kit
- EtherHiding (code stored on a blockchain)
Original research
- Derp2026-08-26Independent researcherFirst account
ClickFix via Cloudflare Zaraz and the BW Panel
This page summarises and structures that research; it is not a substitute for the original.
Researchers: if anything here misrepresents your work, email corrections@clickfixreport.com — we correct within 5 working days, no questions asked.
Summary
Derp published this analysis on 26 August 2026. A malicious JavaScript action delivered through Cloudflare Zaraz, a legitimate tag-management service, on one victim site loaded the bootstrap of the BW Panel, the back end used by ErrTraffic ClickFix campaigns. The loader asks a Polygon smart contract for the panel's current address, sends it an encrypted request, and is handed one of nine presentation modules: fake browser and font updates, reCAPTCHA and Cloudflare checks for Windows or macOS, a blue screen, a Cloudflare update, or a silent mode. The Windows Cloudflare module places the command on the clipboard, reports whether the copy worked, and polls a token endpoint to follow the victim into the next stage.
Execution mechanisms
The only execution mechanism any published account describes for this campaign is Clipboard injection (T1204.004), which 31 of the 61 published campaigns in this corpus also record (51%).
Indicators
4 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.
| Indicator | Type | Role | Assessment | Report an error |
|---|---|---|---|---|
| domain, shown defanged for safety: edgeupstudio dot com | domain | Lure page | Compromised site | Report an error in domain record 5465b723-afdd-42eb-a403-0f04c7cf3cd1 |
| domain, shown defanged for safety: ntsnsdns dot beer | domain | Command and control | Not yet assessed | Report an error in domain record bee19b91-df3e-481c-b944-184d79f0c825 |
| sha256, shown defanged for safety: a9a28c9cb172fe087151db00cd39475382732aa64574f658eca7f08822199e97 | sha256 | Sample | Not yet assessed | Report an error in sha256 record e7ea12c9-0547-4b66-b03b-3153f9f0ebac |
| sha256, shown defanged for safety: bc4a58e1a7e986b01fd24fb56c1aadff66c39e038f2bd781624484b97f8be8a8 | sha256 | Sample | Not yet assessed | Report an error in sha256 record 89792005-e3cb-406e-93bb-b6dc5df192d9 |
“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.
Not on this record
This record does not yet carry a second publisher's account, any overlap with another campaign in this corpus or our own re-checks of these indicators. Each appears on this page as its own section once it exists; none of it is inferred.
Cite as
ClickFixReport, “ErrTraffic BW Panel via Cloudflare Zaraz”, campaign ID 17fdf630, retrieved 2026-10-11, snapshot fb0eed7.
https://clickfixreport.com/campaigns/17fdf630/errtraffic-bw-panel-zaraz
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.