A malware-as-a-service (MaaS) campaign has combined ClickFix social engineering with the ErrTraffic delivery service and Cruciferra loader, giving attackers a way to distribute malware while disabling endpoint security processes.
In a new advisory published earlier today, eSentire’s Threat Response Unit (TRU) described several ErrTraffic-generated ClickFix campaigns observed in late July 2026 that attempted to deliver Cruciferra.
The loader is marketed on underground forums with features designed to kill antivirus and endpoint detection and response (EDR) processes.
Turning Compromised Sites Into ClickFix Delivery Platforms
The campaign began with compromised WordPress sites containing an obfuscated ErrTraffic JavaScript injection.
The script used the Ethereum blockchain to resolve a command-and-control (C2) address before retrieving JavaScript for a fake Google reCAPTCHA, Cloudflare Turnstile or Blue Screen of Death (BSOD) lure.
The lure copied a malicious PowerShell command to the victim’s clipboard and instructed them to paste and run it.
Additional PowerShell stages then used a legitimate Microsoft-signed binary to sideload the Cruciferra DLL, which used process hollowing to inject the Remus information stealer into a second Microsoft-signed binary, ServiceModelReg.exe.
Compromised WordPress sites have previously been used to deliver ClickFix malware, but the eSentire campaign combined the technique with two separate MaaS offerings.
ErrTraffic was advertised for $380 per month and provided operators with customizable ClickFix templates, campaign statistics, filtering and a WordPress plugin generator. Its use of blockchain-based infrastructure also allowed operators to rotate C2 domains without changing the JavaScript injected into compromised websites.
Cruciferra’s EDR-killing package cost $1,200 per month and is marketed as a loader capable of disabling security products.
The payload abused the signed vulnerable DCRCVDrv.sys driver to terminate security-related processes from the Windows kernel. eSentire found 145 process names configured for termination by default, most of them antivirus and EDR products.
The driver is not currently known to Microsoft or LOLDrivers, meaning it will not be caught by the vulnerable driver blocklist. eSentire recommended blocking it directly by hash.
Read more on EDR-killing techniques: Ransomware Groups Increasingly Deploy EDR Kill Technique
The campaign showed how operators could combine separate MaaS products to outsource delivery, social engineering and defense evasion rather than developing each capability themselves.
