ErrTraffic ClickFix Campaign Deploys Cruciferra EDR Killer to Terminate 145 Security Processes

The activity combines fake CAPTCHA pages, PowerShell execution, DLL side-loading, process hollowing, and a vulnerable signed driver to deploy the Remus information stealer.

The campaign begins on compromised WordPress websites injected with obfuscated ErrTraffic JavaScript. ErrTraffic is a malware-as-a-service platform reportedly sold by the actor “LenAI,” offering operators customizable ClickFix templates that impersonate Google reCAPTCHA, Cloudflare Turnstile, and Windows Blue Screen of Death errors.

When a victim opens an infected site, the JavaScript queries a Polygon smart contract to obtain the current command-and-control server.

This blockchain-based dead-drop method lets operators rotate C2 infrastructure without reinfecting or modifying every compromised website. The script then fetches a lure from the C2 server.

Cruciferra EDR Killer Campaign

The lure tells victims to “verify” themselves by opening PowerShell through Windows Key + X, selecting Terminal or PowerShell, and pasting a command already copied to their clipboard.

This is the defining ClickFix technique, instead of exploiting a software flaw, attackers manipulate users into executing the malicious command themselves.

The resulting PowerShell stages use a legitimate Microsoft-signed binary to side-load a malicious mscoree.dll file containing Cruciferra.

DLL side-loading lets attackers place a malicious library beside a trusted application so the legitimate program loads the attacker-controlled file, helping the malware blend into normal activity. MITRE ATT&CK tracks this behavior as T1574.001.

Cruciferra then uses process hollowing to inject Remus into the memory of ServiceModelReg.exe, another Microsoft-signed executable.

In process hollowing, malware starts a legitimate process in a suspended state, replaces its memory with malicious code, and resumes it masking execution under a trusted process name.

Cruciferra, marketed as a malware loader or “crypter,” appeared on underground forums in November 2025. Its PUROSANGUE package reportedly costs $1,200 per month and includes UAC-bypass and EDR-killing options.

The campaign analyzed by TRU used this package to target security products before deploying follow-on payloads. The malware abuses the signed DCRCVDrv.sys driver, associated with South Korean IT firm MocoMsys.

After obtaining administrator privileges, Cruciferra writes the driver to C:\Windows\Temp\DCRCVDrv.sys, registers it as a service, and communicates with it through \\.\DCRCVDRV_U.

The driver exposes IOCTL 0x2205C0, allowing a user-mode process to provide a target process ID. Its vulnerable kernel-mode routine calls ZwTerminateProcess, enabling Cruciferra to stop security tools from the kernel.

This bring-your-own-vulnerable-driver approach is especially dangerous because the driver is signed, allowing attackers to leverage trusted code for destructive behavior, eSentire said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN