ErrTraffic HijackLoader via ClickFix PowerShell dropping bloated archive

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects a multi-stage infection chain associated with HijackLoader delivered via ErrTraffic ClickFix lures. The rule identifies a sequence where a web browser spawns a PowerShell process that subsequently creates a large archive file (binary bloating), followed by the execution of suspicious processes (often associated with process injection/hollowing) from the extracted context.