As outlined in Infosecurity Magazine, a recent malware-as-a-service (MaaS) campaign has emerged, effectively merging ClickFix social engineering tactics with the ErrTraffic delivery service and the Cruciferra loader. This sophisticated operation provides threat actors with a potent method for distributing malware while simultaneously disabling endpoint security processes on targeted systems, as reported by eSentire’s Threat Response Unit (TRU).The campaign, observed in late July 2026, begins with compromised WordPress websites injected with obfuscated ErrTraffic JavaScript. This script utilizes the Ethereum blockchain to resolve command-and-control (C2) addresses, subsequently retrieving JavaScript for deceptive lures such as fake Google reCAPTCHA, Cloudflare Turnstile, or a Blue Screen of Death. Victims are then prompted to copy and execute a malicious PowerShell command. Subsequent PowerShell stages employ a legitimate Microsoft-signed binary to sideload the Cruciferra DLL. This loader, marketed for its ability to disable antivirus and EDR processes, uses process hollowing to inject the Remus information stealer into another signed binary, ServiceModelReg.exe.The Cruciferra loader abuses a vulnerable driver, DCRCVDrv.sys, to terminate a list of 145 security-related processes from the Windows kernel, including most antivirus and EDR products. This combination of MaaS offerings allows attackers to outsource delivery, social engineering, and defense evasion, highlighting a growing trend in sophisticated cybercrime operations.Source: Infosecurity Magazine
