A new malware-as-a-service (MaaS) campaign has been identified that integrates three distinct services: ClickFix for social engineering, ErrTraffic for malware delivery, and Cruciferra as a loader. This combination allows attackers to distribute malware while simultaneously disabling endpoint security measures.
The eSentire Threat Response Unit (TRU) detailed several ErrTraffic-generated ClickFix campaigns observed in late July 2026, which aimed to deliver the Cruciferra loader. Cruciferra is advertised on underground forums for its ability to terminate antivirus and endpoint detection and response (EDR) processes.
The campaign starts with compromised WordPress sites that have an obfuscated ErrTraffic JavaScript injection. This script leverages the Ethereum blockchain to resolve a command-and-control (C2) address. Subsequently, it retrieves additional JavaScript to display a fake lure, such as a Google reCAPTCHA, Cloudflare Turnstile, or a Blue Screen of Death (BSOD).
Victims are then instructed to copy a malicious PowerShell command, which is placed on their clipboard by the lure, and execute it. Further PowerShell stages utilize a legitimate Microsoft-signed binary to sideload the Cruciferra DLL. Cruciferra then employs process hollowing to inject the Remus information stealer into another Microsoft-signed binary, ServiceModelReg.exe.
ErrTraffic, which costs $380 per month, offers operators customizable ClickFix templates, campaign statistics, filtering capabilities, and a WordPress plugin generator. Its use of blockchain-based infrastructure enables operators to rotate C2 domains without needing to alter the JavaScript injected into compromised websites.
Cruciferra, priced at $1,200 per month, is marketed as a loader designed to disable security products. It achieves this by abusing the signed vulnerable driver DCRCVDrv.sys to terminate security-related processes from the Windows kernel. eSentire discovered that Cruciferra is configured by default to terminate 145 process names, primarily those associated with antivirus and EDR products.
The DCRCVDrv.sys driver is not currently known to Microsoft or listed in the LOLDrivers database, meaning it will not be blocked by existing vulnerable driver blocklists. eSentire recommends blocking this driver directly by its hash.
This campaign highlights a growing trend where operators combine separate MaaS products to outsource various aspects of an attack, including delivery, social engineering, and defense evasion, rather than developing these capabilities in-house.
