Listen to this Post
Introduction: When a Simple CAPTCHA Becomes a Trap
Cyberattacks are becoming less dependent on sophisticated exploits and more dependent on convincing people to perform the final malicious action themselves. The latest ClickFix campaign uncovered by eSentire is a powerful example of that shift, combining social engineering, compromised websites, blockchain-backed infrastructure, malware-as-a-service and kernel-level security evasion into one highly organized attack chain.
A New Generation of Malware Delivery
According to
The Bigger Problem Behind ClickFix
ClickFix has become one of the most effective social-engineering techniques because it does not necessarily require criminals to exploit a software vulnerability. Instead, victims are manipulated into believing that their browser, computer or verification process needs their assistance.
The Familiar “Fix” That Installs Malware
A victim may encounter a fake Google reCAPTCHA, Cloudflare Turnstile verification or even a convincing Windows Blue Screen of Death-themed page. Rather than simply clicking a button, the page tells the victim to perform a supposedly harmless troubleshooting step.
The Clipboard Becomes the Attack Vector
In this campaign, the malicious page copied a PowerShell command directly into the victim’s clipboard. The victim was then instructed to paste the command into a terminal and execute it.
Why This Technique Works
The danger is psychological as much as technical. The victim is not necessarily told to download an unknown executable. Instead, the instruction is framed as a normal verification or repair procedure.
The Human Element Is the Exploit
This is precisely what makes ClickFix campaigns so difficult to eliminate. Traditional endpoint defenses are designed to detect malicious files, suspicious processes and abnormal network behavior. But the initial execution can begin with a legitimate user launching a legitimate Windows component.
Compromised WordPress Sites Become Malware Gateways
The campaign began with compromised WordPress websites containing an obfuscated ErrTraffic JavaScript injection. This gave attackers an enormous advantage: they could hide their malicious infrastructure behind legitimate websites that victims might already trust.
The Website Does Not Need to Look Malicious
A compromised site can continue functioning normally while quietly delivering malicious JavaScript to selected visitors. Attackers can also use filtering mechanisms to determine which visitors receive the malicious content.
Blockchain Adds Another Layer of Resilience
One of the more interesting elements of the campaign was the use of the Ethereum blockchain to resolve the command-and-control address. This allowed the attackers to separate the compromised website from the location of their active infrastructure.
Why Blockchain-Based C2 Matters
If criminals simply hard-code a conventional command-and-control domain into injected JavaScript, defenders can block that domain and potentially disrupt the campaign. Blockchain-based resolution makes infrastructure rotation more flexible.
The Attack Chain Keeps Getting Deeper
Once the victim executed the PowerShell command, additional stages were launched. The attackers then used a legitimate Microsoft-signed binary to sideload the Cruciferra DLL.
Living Off Legitimate Components
This is another important characteristic of modern malware campaigns. Attackers increasingly abuse trusted Windows binaries rather than relying entirely on obviously malicious executables.
Signed Does Not Always Mean Safe
A valid Microsoft signature can establish trust in the origin of a binary, but it does not automatically guarantee that every DLL loaded by that binary is trustworthy. DLL sideloading takes advantage of this distinction.
Cruciferra Enters the Picture
The Cruciferra loader was designed as a malware delivery component with an especially dangerous capability: disabling security software and EDR processes.
From User Execution to Security Evasion
The campaign therefore moved through several stages:
A legitimate website is compromised.
Malicious JavaScript is injected.
ErrTraffic determines whether the visitor should receive the lure.
A fake CAPTCHA, Turnstile or BSOD page appears.
A malicious PowerShell command is placed in the clipboard.
The victim is persuaded to execute it.
Additional PowerShell stages are downloaded or launched.
A legitimate Microsoft-signed binary is abused for DLL sideloading.
Cruciferra is loaded.
Cruciferra uses process-hollowing techniques to introduce the Remus information stealer.
Security processes are targeted for termination.
The attacker can proceed with credential and information theft.
Process Hollowing Adds Another Layer
Cruciferra reportedly used process hollowing to inject the Remus information stealer into another Microsoft-signed binary, ServiceModelReg.exe.
Why Process Hollowing Is Still Relevant
Process hollowing allows malware to execute malicious code within the context of another process. When combined with trusted binaries and other evasion techniques, it can complicate detection and investigation.
Remus Turns Delivery Into Theft
The final objective is not simply to disable antivirus software. The chain ultimately delivers an information stealer, turning the initial ClickFix interaction into a potential credential and data compromise.
ErrTraffic: Malware Delivery as a Service
The campaign is particularly concerning because attackers did not need to build every component themselves. ErrTraffic was reportedly advertised for approximately $380 per month.
What ErrTraffic Offers Criminal Operators
The service reportedly included customizable ClickFix templates, campaign statistics, filtering capabilities and a WordPress plugin generator.
Criminals Can Buy the Infrastructure
This represents an important evolution in cybercrime. Instead of developing a complete phishing or malware delivery platform, an attacker can rent the infrastructure and concentrate on selecting targets.
Cruciferra: The Defense-Evasion Component
Cruciferra was reportedly marketed for approximately $1,200 per month as a loader capable of disabling security products.
The Cost of an EDR-Killing Service
For cybercriminals, spending $1,200 per month may appear expensive. But compared with the potential financial returns from stolen credentials, corporate access, cryptocurrency wallets or ransomware operations, the investment can be relatively small.
The Kernel Is Where the Campaign Gets Serious
According to eSentire, Cruciferra abused the signed vulnerable DCRCVDrv.sys driver to terminate security-related processes from the Windows kernel.
Why Kernel-Level Access Changes the Game
Security software operating at the user level can be difficult to disable when protected properly. Kernel-level capabilities can provide attackers with significantly greater control over what happens on the machine.
A Long List of Security Targets
eSentire reportedly observed 145 process names configured for termination by default. Most were associated with antivirus and EDR products.
The Vulnerable Driver Problem
The incident highlights the continuing challenge created by legitimate but vulnerable signed drivers. Windows can trust a driver because it is digitally signed, while attackers can abuse a vulnerability inside that driver to perform actions that security software was designed to prevent.
Why the Blocklist Matters
The driver was reportedly not known to Microsoft or LOLDrivers at the time of the investigation. As a result, it was not expected to be covered by Microsoft’s vulnerable-driver blocklist.
Hash-Based Blocking Becomes Important
eSentire recommended defenders block the specific driver directly by hash. This illustrates why organizations cannot depend exclusively on broad operating-system security controls.
The MaaS Model Is the Real Story
The most important aspect of this campaign may not be any individual component. It is the way separate criminal services were chained together.
Cybercrime Is Becoming Modular
One criminal group can specialize in traffic delivery. Another can provide social-engineering templates. A third can sell a loader. A fourth can maintain an information stealer.
Attackers Are Buying Capabilities
This is similar to legitimate cloud services, except the objective is criminal. Attackers can increasingly assemble an operation from prebuilt components.
The Barrier to Entry Keeps Falling
Historically, running a sophisticated malware campaign required considerable technical expertise. MaaS changes that equation by allowing less-skilled criminals to rent mature capabilities.
ClickFix Makes the Initial Stage Cheap
The social-engineering component is especially attractive because it can avoid the need for a complex browser exploit or zero-day vulnerability.
Trust Is the Commodity
A fake CAPTCHA works because users already understand what a CAPTCHA is supposed to do. A fake Cloudflare verification page works because Cloudflare is familiar. A fake Windows error works because users expect operating systems to display technical instructions.
The Attack Abuses Familiarity
The more familiar the visual language becomes, the less suspicious the victim may feel. Attackers are effectively turning cybersecurity awareness itself into part of the deception.
Deep Analysis: Breaking Down the Technical Chain
Initial JavaScript Injection
Defenders investigating compromised WordPress infrastructure should search for unexpected JavaScript injections, especially heavily obfuscated scripts or code that dynamically constructs URLs and redirects.
Suspicious PowerShell Activity
A useful starting point for defensive investigation is reviewing PowerShell logging for encoded commands, unusual download activity and suspicious child processes.
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" |
Where-Object {$_.Id -in 4103,4104} |
Select-Object TimeCreated, Id, Message
Search for Suspicious PowerShell Encodings
Organizations can investigate encoded PowerShell activity with:
Get-WinEvent -FilterHashtable @{
LogName = "Microsoft-Windows-PowerShell/Operational"
Id = 4104
} | Select-Object TimeCreated, Message
The objective is not to execute suspicious content, but to identify unusual command patterns that deserve investigation.
Look for DLL Sideloading
Security teams should also investigate cases where legitimate signed Windows binaries load DLLs from unexpected directories.
Get-Process | Select-Object Name, Id, Path
For enterprise investigations, tools such as Sysmon, Microsoft Defender telemetry and EDR process-tree data can provide considerably more useful evidence than a simple process listing.
Investigate Unexpected Drivers
Defenders should inventory recently loaded drivers and compare them against approved software baselines.
Get-CimInstance Win32_SystemDriver | Select-Object Name, State, StartMode, PathName
Unexpected drivers should be investigated before they are simply deleted, because removing evidence prematurely can make incident response harder.
Monitor Security-Service Tampering
Organizations should alert on attempts to stop, disable or terminate security products. A sudden sequence involving PowerShell, a signed executable, an unusual DLL and security-process termination should be treated as a high-priority event.
Block Known Malicious Artifacts
If a specific malicious driver hash has been confirmed during an investigation, defenders can use their endpoint security platform, application-control policy or organizational blocklisting mechanism to prevent execution.
Investigate → Validate → Hash → Block → Hunt → Monitor
Why Detection Must Be Behavioral
Blocking one DLL or one hash may stop the exact campaign, but it does not eliminate the underlying technique. The next campaign can use another loader, another driver or another signed executable.
Build Detection Around the Chain
A stronger detection strategy looks for combinations such as:
Browser
↓
↓
Signed Binary
↓
Unexpected DLL
↓
Driver Activity
↓
Security Process Termination
↓
Information Stealer
The combination is often more meaningful than any individual event.
Defending Against ClickFix
Organizations should train users specifically against instructions that ask them to open PowerShell, Command Prompt or Terminal and paste commands copied from a webpage.
A Simple Rule for Employees
A legitimate CAPTCHA should not normally require a user to manually execute a PowerShell command. That single principle can prevent many ClickFix infections.
Browser Security Still Matters
Web filtering, DNS protection, browser isolation and endpoint detection can reduce exposure to compromised websites. Security teams should also monitor unusual JavaScript behavior on their own web properties.
WordPress Administrators Have a Role
Organizations operating WordPress sites should keep WordPress core, themes and plugins updated, remove unused plugins and enforce strong administrator authentication.
Compromised Websites Need Immediate Investigation
If a WordPress website has been compromised, simply removing the visible malicious script may not be enough. Administrators should investigate administrator accounts, plugins, scheduled tasks, server-side files and persistence mechanisms.
EDR Alone Is Not Enough
The campaign is a reminder that endpoint security should be treated as one layer rather than the entire defense strategy. If an attacker successfully tampers with endpoint defenses, identity, network, application and logging controls still need to provide visibility.
Identity Protection Becomes Critical
Because the delivered Remus information stealer can potentially target credentials and sensitive information, organizations should use phishing-resistant authentication where possible and monitor for suspicious authentication activity.
Session Theft Is Also a Concern
Stealing credentials is only one part of the modern identity threat. Attackers increasingly seek browser sessions, authentication tokens and stored secrets that may allow them to bypass password protections.
Incident Response Should Assume Expansion
If Cruciferra or another EDR-killing loader is discovered, defenders should not treat the disabled security process as an isolated incident. The endpoint should be considered potentially compromised until evidence proves otherwise.
The Correct Response Is Containment First
Affected systems should be isolated, relevant credentials should be assessed for exposure and forensic evidence should be preserved. Security teams should then hunt for the same indicators across the wider environment.
What Undercode Say:
The Real Innovation Is Criminal Coordination
The most disturbing element of this campaign is not necessarily ClickFix itself.
It is the combination of multiple commercially available criminal services.
ErrTraffic handles delivery and social engineering.
Cruciferra handles loading and defense evasion.
Remus provides the information-stealing capability.
The attacker effectively assembles a complete intrusion chain.
This resembles a criminal technology stack.
Each component can be replaced independently.
That makes the ecosystem more resilient.
It also allows specialized developers to sell their capabilities to multiple criminal customers.
The victim, meanwhile, experiences everything as a single attack.
The initial website may look harmless.
The fake CAPTCHA may look familiar.
The PowerShell command may appear to be a verification step.
The signed Microsoft binary may look legitimate.
The EDR-killing driver may initially appear unrelated.
Yet all of those pieces can belong to one carefully orchestrated chain.
This is why defenders need to stop thinking only in terms of malware samples.
The more important question is how the attack behaves.
What launched PowerShell?
What did PowerShell launch?
Which DLL was loaded?
Where did that DLL originate?
Which driver appeared afterward?
Which security processes suddenly stopped?
Was there unusual browser activity immediately before the chain began?
Was the endpoint contacting an unfamiliar infrastructure provider?
Did authentication anomalies appear after the infection?
These questions create a much stronger defensive picture.
ClickFix also demonstrates that social engineering remains incredibly powerful.
Attackers do not always need to defeat security software directly.
Sometimes they convince the user to open the door.
Once that happens, legitimate operating-system tools can become part of the attack.
The MaaS economy makes this even more dangerous.
Criminal developers can focus on specialized capabilities rather than building complete malware families.
The financial model also makes experimentation easier.
A campaign can be launched, measured and modified.
Successful templates can be reused.
Unsuccessful ones can be abandoned.
Infrastructure can be rotated.
This creates an industrialized approach to cybercrime.
The use of blockchain-backed infrastructure adds another layer of operational flexibility.
The use of signed binaries adds another layer of trust abuse.
The vulnerable driver adds another layer of defense evasion.
The information stealer adds the final monetization opportunity.
Individually, these techniques are already familiar to experienced defenders.
Together, they become considerably more dangerous.
The lesson for security teams is therefore straightforward: defend against attack chains, not just malware names.
✅ ClickFix Social Engineering Is the Core Delivery Mechanism
The supplied report states that victims were presented with fake verification and BSOD-themed lures that instructed them to execute PowerShell commands.
This is consistent with the broader ClickFix technique, where victims are manipulated into performing actions that initiate malware execution.
✅ ErrTraffic and Cruciferra Represent Separate MaaS Capabilities
The campaign reportedly combined ErrTraffic’s delivery and ClickFix functionality with Cruciferra’s loader and security-evasion capabilities.
That distinction is important because the operation demonstrates how multiple criminal services can be chained together.
✅ Cruciferra Was Reported to Target Security Processes
eSentire reported that the loader used a vulnerable signed driver to terminate security-related processes, with 145 process names configured by default.
This makes the campaign significantly more serious than a conventional malware-delivery operation.
⚠️ The Driver-Blocklist Situation Can Change
The report states that DCRCVDrv.sys was not known to Microsoft or LOLDrivers at the time of eSentire’s investigation.
That status can change as vendors analyze and add malicious or vulnerable drivers to their detection and blocking mechanisms.
❌ A Digital Signature Does Not Mean the Entire Attack Is Legitimate
A signed Microsoft binary being present in an attack chain does not mean Microsoft created or endorsed the malicious activity.
Attackers can abuse legitimate signed components through techniques such as DLL sideloading.
✅ MaaS Lowers the Technical Barrier for Criminal Operators
The campaign demonstrates how criminals can rent specialized infrastructure rather than independently developing delivery, evasion and payload components.
This modular model is one of the major reasons modern cybercrime ecosystems continue to scale.
Prediction
(+1) ClickFix Will Become More Customized and Convincing
ClickFix-style attacks are likely to evolve beyond generic fake CAPTCHA pages. Attackers can increasingly customize lures around the user’s operating system, browser, language, organization and apparent technical problem.
(+1) MaaS Components Will Become More Interoperable
Criminal developers are likely to build products specifically designed to work with other underground services. Instead of selling isolated malware, future MaaS offerings may increasingly advertise compatibility with delivery networks, loaders, stealers and evasion tools.
(+1) EDR-Killing Techniques Will Trigger Stronger Driver Controls
The growing abuse of vulnerable signed drivers will likely encourage operating-system vendors and security companies to improve vulnerable-driver blocklists, kernel protections and behavioral detection.
(+1) Behavioral Detection Will Become More Important
Security platforms will increasingly need to detect suspicious sequences rather than individual binaries. A browser-to-PowerShell-to-DLL-to-driver-to-security-process-termination chain is far more revealing than any single event.
(-1) Traditional User Training Alone Will Not Stop the Threat
Security awareness remains important, but attackers continuously redesign their lures. Organizations that depend entirely on users recognizing suspicious pages will remain vulnerable.
(-1) Compromised Websites Will Continue to Be Attractive
As long as legitimate websites can be compromised and used to deliver malicious JavaScript, attackers will continue exploiting the trust users place in familiar domains.
(-1) Security Products Will Remain High-Value Targets
Attackers have learned that disabling the defender can be more valuable than immediately attacking the final payload. As a result, EDR tampering and security-process termination are likely to remain prominent components of advanced malware campaigns.
Final Thoughts: The Attack Starts With Trust
The ErrTraffic, ClickFix and Cruciferra campaign illustrates where modern malware operations are heading: toward modular, outsourced and highly adaptable attack chains.
The victim may believe they are completing a CAPTCHA.
The browser may appear legitimate.
The Windows binary may be properly signed.
The command may look like a technical fix.
But behind those familiar elements can sit an entire criminal supply chain.
That is the central lesson from this campaign. Modern attackers do not necessarily need to invent a revolutionary exploit when they can combine existing techniques into a highly efficient service-based operation.
For defenders, the answer is equally modular: harden websites, restrict unnecessary scripting and PowerShell abuse, monitor signed-binary execution, control vulnerable drivers, protect identities, preserve centralized telemetry and detect attempts to interfere with security software.
The most dangerous malware may not be the file that arrives first.
It may be the chain of perfectly ordinary-looking actions that convinces a victim to let the attacker in.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
