Threat actors are pairing fake CAPTCHA verification pages with a commercial malware loader capable of disabling endpoint defenses, creating a high-impact infection chain that begins with a victim manually executing a malicious PowerShell command.
In late July 2026, multiple ClickFix campaigns generated through the ErrTraffic malware-as-a-service platform and used to deliver Cruciferra, a loader advertised on underground forums for its EDR-killing functionality.
eSentire’s TRU conducts original threat research and develops detection content for emerging campaigns.
Victims are directed to compromised WordPress sites seeded with an obfuscated JavaScript implant.
The ErrTraffic script decodes its configuration, queries a Polygon smart contract to obtain an active command-and-control domain, and retrieves JavaScript for a customized ClickFix page.
The page impersonates Google reCAPTCHA, Cloudflare Turnstile, or a Windows Blue Screen of Death and places a PowerShell command in the victim’s clipboard.
The lure then instructs the victim to open PowerShell through the Windows Quick Link menu, paste the clipboard contents, and run it.
This interaction is crucial: rather than exploiting a browser or operating-system flaw, the campaign convinces users to execute the infection chain themselves, potentially bypassing controls that focus only on malicious downloads or drive-by exploitation.
ErrTraffic is sold as a service by an actor known as LenAI, reportedly for $380 per month.
Its operator panel supports lure customization, geofencing and referrer filtering, campaign analytics, payload delivery, and tools for generating WordPress injects.
Its use of Polygon smart contracts as a dead-drop resolver gives operators a resilient way to rotate C2 infrastructure without modifying JavaScript already implanted across compromised websites.
eSentire Researchers said that, the activity demonstrates how social engineering, blockchain-backed command-and-control infrastructure, DLL side-loading, and Bring Your Own Vulnerable Driver techniques can be assembled into a repeatable malware-delivery service.
Fake CAPTCHA to Deploy Malware
The subsequent stages load Cruciferra through a legitimate Microsoft-signed executable and a malicious mscoree.dll.
This is DLL side-loading, tracked by MITRE ATT&CK as T1574.001, where attackers plant a malicious DLL so a trusted application loads it.
The technique can conceal execution under a legitimate process and reduce the effectiveness of reputation-based controls.
Cruciferra then uses process hollowing to inject the Remus information stealer into the address space of ServiceModelReg.exe, another Microsoft-signed binary.
Within the ErrTraffic panel, operators are able to customize the appearance of the lure, either as a CloudFlare/Google CAPTCHA or Blue Screen of Death (BSOD) error, the name of the domain shown in the CAPTCHA page.
MITRE describes process hollowing as creating a suspended process, replacing its memory with malicious code, and resuming it so malware executes under the identity of an apparently legitimate process.
The most damaging optional component is Cruciferra’s EDR killer. When configured by its operator and executed with administrator privileges, the malware attempts UAC bypass via the COM Elevation Moniker, drops the signed-but-vulnerable MocoMsys driver DCRCVDrv.sys into C:\Windows\Temp\, and registers it as a service.
The driver exposes an IOCTL that enables user-mode software to request kernel-mode termination of arbitrary processes.
Cruciferra uses this capability to terminate 145 AV and EDR-related processes, including those associated with Microsoft Defender, Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, Sophos, Bitdefender, Cortex XDR, and others.
This is a BYOVD attack: an adversary abuses a legitimate vulnerable driver to gain kernel-level functionality and tamper with security tooling.
Earlier Cruciferra research similarly documented the loader’s use of vulnerable helper drivers, API and IAT unhooking, indirect system calls, UAC bypass, and anti-analysis mechanisms.
Proofpoint assessed Cruciferra as a crypter service used by multiple unrelated cybercriminal groups to deliver RATs and information stealers.
Defenders should treat fake verification pages that require copying commands into a shell as malicious by default.
Organizations should block or tightly govern PowerShell, monitor unexpected driver-service creation and writes to Windows temporary directories, enable Microsoft’s vulnerable-driver blocklist where applicable, and alert on suspicious DLL loads by signed binaries.
Hunting should also prioritize PowerShell launched from user-driven browser activity, anomalous ServiceModelReg.exe execution, process-hollowing telemetry, and outbound requests to blockchain RPC infrastructure associated with suspicious web injects.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
