MaaS Attack Chain Merges ClickFix, ErrTraffic, Cruciferra

A newly observed malware-as-a-service (MaaS) operation is stitching together three distinct criminal tools into a single, potent attack chain. By pairing the ClickFix social engineering trick with the ErrTraffic delivery service and the Cruciferra loader, the threat actors behind this campaign have found a streamlined way to push malware onto victim machines while simultaneously knocking out endpoint defenses.

Security researchers at eSentire’s Threat Response Unit (TRU) released an advisory today detailing the campaign. The analysis covers several ErrTraffic-generated ClickFix lures observed in late July 2026, all of which were engineered to drop the Cruciferra payload. That loader, which is actively marketed on cybercrime forums, comes with a specific selling point: the ability to terminate antivirus and endpoint detection and response (EDR) agents running on a compromised host.

The attack sequence kicked off on hijacked WordPress sites. The attackers injected an obfuscated JavaScript payload from ErrTraffic into these legitimate pages. Rather than relying on a static server address, the script turned to the Ethereum blockchain to resolve its command-and-control (C2) infrastructure. From there, it fetched additional JavaScript that presented victims with one of several convincing lures, including a fake Google reCAPTCHA check, a Cloudflare Turnstile prompt, or a simulated Blue Screen of Death.

Each of those lures served the same purpose: tricking the user into copying a malicious PowerShell command to their clipboard and running it manually. Subsequent PowerShell stages leveraged a legitimate, Microsoft-signed binary to sideload the Cruciferra DLL. Once active, the loader employed process hollowing to inject the Remus information stealer into another signed Microsoft executable, ServiceModelReg.exe, allowing the final payload to run under the guise of a trusted process.

While compromised WordPress sites have long been a vector for ClickFix distribution, this particular operation stands out for its modular approach. It effectively outsources three separate phases of the kill chain to two different commercial services.

ErrTraffic, which the researchers noted was advertised for $380 per month, gave its customers a full toolkit for running these campaigns. Subscribers received customizable ClickFix templates, real-time campaign statistics, traffic filtering options, and even a plugin generator for WordPress. The blockchain-based C2 mechanism offered another advantage: operators could rotate their command servers at will without ever needing to touch the JavaScript already sitting on the compromised websites.

The second piece of the puzzle, Cruciferra, came with a heftier price tag of $1,200 per month. It is pitched on underground markets as a loader built specifically for disabling security products. In practice, the malware abused a signed but vulnerable kernel driver, DCRCVdrv.sys, to terminate security-related processes from the Windows kernel. eSentire’s investigation found 145 distinct process names configured for termination by default, with the vast majority belonging to antivirus and EDR vendors.

Notably, this particular driver has not yet been catalogued by Microsoft or the LOLDrivers project. That means it currently slips past the vulnerable driver blocklist built into Windows. The researchers recommended that defenders block the driver directly by its hash as a stopgap measure.

This campaign illustrates a growing trend in the cybercriminal ecosystem: rather than building every component in-house, operators are increasingly mixing and matching specialized MaaS offerings. By combining ErrTraffic’s delivery and social engineering infrastructure with Cruciferra’s defensive evasion capabilities, the attackers were able to assemble a full operational pipeline with minimal development effort on their own part.