It's one of the pre-built templates that the threat actor can choose from when they use the Clickfix-as-a-service ErrTraffic.
And yeah they had a compromised account that was used to get their WordPress instance to inject it.
Tommy Madjar
@ffforward.bsky.social
444 followers 65 following 11 posts
Threat Researcher @ Proofpoint. Opinions are my own etc
