Malware-as-a-Service Campaign Targets Users with ClickFix and Cruciferra

A new Malware-as-a-Service (MaaS) campaign has emerged, utilizing ErrTraffic and Cruciferra to distribute malware while evading endpoint security. The campaign, identified by eSentire's Threat Response Unit, began in late July 2026 and involved compromised WordPress sites delivering obfuscated JavaScript that resolved command-and-control addresses via the Ethereum blockchain. Attackers employed social engineering tactics, including fake Google reCAPTCHA and BSOD lures, to trick users into executing malicious PowerShell commands. The Cruciferra loader, marketed on underground forums, is designed to disable antivirus and EDR processes by exploiting a vulnerable driver, DCRCVDrv.sys. This driver is not recognized by Microsoft’s blocklist, making it particularly dangerous. Organizations are advised to block the vulnerable driver directly and implement security awareness training to mitigate risks. The campaign highlights the increasing sophistication of MaaS offerings in cybercrime.

Key Points: • The campaign combines ErrTraffic and Cruciferra to distribute malware and evade security. • Attackers use compromised WordPress sites and social engineering tactics to deliver payloads. • The vulnerable DCRCVDrv.sys driver allows attackers to disable security processes at the kernel level.