Do Son 
ClickFix lure
At a glance
| Malware family | Cruciferra malware loader (delivers Remus stealer) |
| Threat actor | Cruciferra and LenAI (ErrTraffic) sellers; operators unknown |
| Target or victims | Windows users visiting compromised WordPress sites |
| Delivery vector | ClickFix lures via ErrTraffic JavaScript injects |
| Key capabilities | DLL sideloading, process hollowing, BYOVD EDR killing |
| Source | eSentire Threat Response Unit; Infosecurity Magazine; Sekoia |
TL;DR
The Cruciferra malware loader is turning up in fresh ClickFix campaigns tracked by eSentire in late July 2026. Attackers trick users into running PowerShell, then load a signed but vulnerable driver. That driver lets the malware shut down 145 antivirus and EDR processes from the kernel.
Two rented tools, one attack
This campaign pairs two separate crimeware products. eSentire’s Threat Response Unit (TRU) found several ErrTraffic-generated ClickFix campaigns pushing the loader.
ErrTraffic handles delivery. According to eSentire, the Cruciferra Malware-as-a-Service “first appeared in November 2025 and is currently sold for $1200 per month for the package with EDR killing features.” ErrTraffic, sold by an actor named LenAI, costs $380 per month.
Delivery
Victims first land on a hacked WordPress site. An obfuscated ErrTraffic script sits inside the page. That script fakes a Google reCAPTCHA, a Cloudflare Turnstile check, or a blue screen error.
Next, the lure copies a hidden PowerShell command to the clipboard. It then tells the user to open PowerShell and paste it. This social trick is called ClickFix, and it puts the user in charge of running the code.
Infection chain
The PowerShell command kicks off several stages. First, a Microsoft-signed program sideloads the Cruciferra DLL. Then the loader uses process hollowing to inject the Remus information stealer into another signed binary, ServiceModelReg.exe.
When the EDR-killer feature is on, the malware goes further. It drops a signed but vulnerable driver named DCRCVDrv.sys. Infosecurity Magazine and eSentire both note this driver is signed by a South Korean IT firm.
How the C2 stays hidden
ErrTraffic hides its command-and-control address on a blockchain. The inject reads a smart contract to resolve the live C2 domain. As a result, operators rotate domains without editing code on hundreds of sites.
Sekoia researchers describe the same dead-drop method, known as EtherHiding. This makes simple domain blocking far less useful for defenders.
How the EDR killer works
The driver is the heart of the attack. It exposes a control interface that lets a normal app terminate processes from the kernel. Because the driver is signed, Windows trusts it.
The loader scans running processes and hashes their names. It then sends matching process IDs to the driver. The driver kills each one using a kernel function. In total, the malware targets 145 antivirus and EDR process names by default.
This method is called BYOVD, or “bring your own vulnerable driver.” It bypasses user-mode defenses that most tools rely on.
Attribution
Attribution here is limited. The seller handles “Cruciferra” and “LenAI” are known, yet the operators behind each campaign remain unconfirmed. TRU assessed with high confidence that this sample came from Cruciferra’s “PUROSANGUE” package.
Defense and detection guidance
Teams can blunt this threat with a few steps. Watch for signed programs loading DLLs from odd folders. Also alert on new kernel drivers written to temporary paths.
Flag attempts to stop or disable security services, especially after browser-based ClickFix activity. In addition, block untrusted PowerShell launched from the Run box or clipboard. Finally, keep endpoints patched and enable driver-load and kernel protections.
Indicators exist for this campaign, including a payload hash and a vulnerable driver name. eSentire lists them in its full write-up for detection teams.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
