Loading story…
Late-July campaigns used the ErrTraffic malware-as-a-service platform and ClickFix social engineering to lure victims from compromised WordPress sites into running malicious PowerShell copied to their clipboard. The infection chain fetched fake verification pages, resolved command-and-control through Polygon smart contracts, and used DLL side-loading before hollowing the Remus information stealer into the legitimate Microsoft-signed binary ServiceModelReg.exe.
The Cruciferra loader provided the campaign’s defense-evasion capability by abusing the signed but vulnerable DCRCVDrv.sys driver in a bring-your-own-vulnerable-driver attack to terminate antivirus and EDR processes at kernel level. Researchers said Cruciferra is marketed separately as a MaaS offering, with higher-tier options for UAC bypass and EDR killing, while ErrTraffic is sold as a delivery service with customizable lures and campaign management, showing how operators can combine modular criminal services to distribute infostealers and disable endpoint protections.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed that the late-July 2026 ErrTraffic ClickFix campaign delivered both the Cruciferra loader and the Remus information stealer. They also revealed that Cruciferra used the signed vulnerable DCRCVDrv.sys driver in a bring-your-own-vulnerable-driver technique to kill 145 antivirus and EDR-related processes.
In late July 2026, eSentire identified several ErrTraffic-generated ClickFix campaigns that attempted to deliver the Cruciferra malware loader via compromised WordPress sites. The infection chain used fake verification lures to trick victims into running malicious PowerShell.
Cruciferra first appeared in November 2025 as a malware-as-a-service offering marketed on underground forums as a loader or crypter with endpoint security-killing capabilities.
LOLDrivers documented that DCRCVDrv.sys exposes IOCTL 0x2205C0, which accepts a PID and invokes ZwTerminateProcess. It also identified Cruciferra's use of C:\Windows\Temp\DCRCVDrv.sys, a driver service, the \\.\DCRCVDRV_U device path, and hashes for the abused driver sample.
Cruciferra was reportedly observed abusing the signed Alinubx.sys driver to terminate antivirus and EDR processes through its arbitrary-process-termination IOCTL functionality. The driver invokes ZwTerminateProcess and can be used in BYOVD attacks against Windows endpoints.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourceinfosecurity-magazine.com
Open sourceesentire.com
Open sourceloldrivers.io
Open sourceloldrivers.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **ErrTraffic**, a growing malware-as-a-service framework that injects JavaScript into compromised WordPress sites to present **ClickFix** lures and deliver malware. The operation uses **EtherHiding** on the Polygon blockchain to conceal and rotate command-and-control infrastructure, and investigators identified two clusters—**Analytics** and **Beer**—with different smart-contract usage, C2 methods, JavaScript implementations, and payload delivery patterns. The **Beer** cluster is assessed as the active rental service used by multiple affiliates, while **Analytics** appears tied to a single operator using acquired source code. Campaigns linked to ErrTraffic used stolen WordPress administrator credentials, PHP backdoors, malicious MU-plugins, and fake AI-themed sites impersonating **Google Antigravity** and **ChatGPT** to distribute malware including **Vidar**, **Stealc**, **DanaBot**, **HijackLoader**, **Remus**, **Salat**, and **SmokeLoader**. Separate reporting also exposed a live malware distribution backend after a researcher found an unsecured PHP installer at `/install/install.php`, allowing administrative access to the panel that managed hosted payloads, dynamic download pages, and multi-stage redirection chains; although the operators patched that weakness, the infrastructure reportedly remains active. Defenders were provided with domains, delivery URLs, and file hashes to support detection and response.
Jul 12, 2026
Proofpoint reported that the **Cruciferra** crypter-as-a-service is being used by multiple unrelated cybercriminal actors to deliver commodity malware, particularly RATs and infostealers, through email-borne campaigns. Marketed since fall 2025 on `exploit[.]in` with subscription tiers ranging from **$450 to $2,000 per month**, the service has been tied to campaigns distributing **AsyncRAT, XWorm, zgRAT, Agent Tesla, Formbook, XLoader, Phantom Stealer,** and **Remcos**. Financial services, healthcare, and government organizations appeared frequently among targets, while observed lures included tax-themed messages linked to **TA4922** and hospitality-themed campaigns delivering **zgRAT**. Researchers said Cruciferra is under active development, with both production and testing variants observed and VirusTotal metadata indicating frequent rebuilds and redeployment. The crypter, written in **Mono**, combines layered evasion and anti-analysis techniques including **DLL side-loading, decoy exports, indirect syscalls, API and IAT unhooking, BYOVD-based EDR tampering, persistence, UAC bypass,** and a customized **Process Ghosting** implementation, alongside more than **90** custom or hybrid cryptographic routines designed to conceal payloads and hinder static analysis. Microsoft documentation on the **COM Elevation Moniker** provides context for one of the Windows privilege-elevation mechanisms relevant to the UAC bypass tradecraft described in the analysis.
Aug 11, 2026
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026