high August 26, 2026

ErrTraffic and Cruciferra: Malware-as-a-Service ClickFix Delivery Paired With a Kernel-Mode EDR Killer

In late July 2026, an incident response investigation identified multiple ClickFix campaigns generated by the ErrTraffic Malware-as-a-Service platform being used to deliver payloads packed by a second, unrelated service called Cruciferra. Both services are sold on Russian-speaking underground forums, with ErrTraffic providing delivery and Cruciferra offering payload execution and endpoint security evasion. Cruciferra has been advertised since November 2025 in two tiers: a side-loaded DLL capable of terminating antivirus and EDR processes, and a standalone executable that adds Windows Defender exclusions. Operators provide their own final-stage malware, which in the observed campaigns was the Remus information stealer.

Initial access begins on compromised WordPress sites injected with an obfuscated JavaScript loader. The obfuscated script uses Base64 encoding and single-byte XOR encryption. Once decoded, it queries a Polygon smart contract to resolve the active command-and-control domain and loads the lure from that server. The lure impersonates Google reCAPTCHA, Cloudflare Turnstile, or a Windows blue-screen error, then copies a PowerShell command to the victim’s clipboard and instructs them to open a terminal from the Windows Quick Link menu and execute it. Additional PowerShell stages ultimately launch a legitimate Microsoft-signed executable that side-loads the Cruciferra DLL, which injects Remus into a hollowed Microsoft-signed process.

Cruciferra performs privilege escalation and defense evasion primarily through the Windows API, avoiding command-line utilities. It resolves required APIs from kernel32.dll and ntdll.dll using custom export hashing and decrypts embedded strings at runtime. When enabled by the operator, the loader requests elevation through the COM elevation moniker and deploys an embedded copy of DCRCVDrv.sys to a system temporary directory, registers it as a service, and opens a handle to the driver. It then enumerates running processes and sends matching process IDs to the driver through a device control request. The driver terminates them from kernel mode, targeting 145 antivirus and EDR process names across more than 30 vendors, with support for additional custom targets configured through the Cruciferra panel.

ErrTraffic stores its active command-and-control domain in two Polygon smart contracts, which the injected script queries through fourteen public blockchain RPC providers for redundancy. Operators periodically update the domain on-chain, propagating the change across all compromised websites without modifying the injected JavaScript. Because this lookup occurs in the victim’s browser, both the blockchain request and the initial connection to attacker infrastructure appear as browser activity. Despite frequent domain rotation, the underlying hosting is comparatively stable. A single IP address, 178.16.52[.]101, hosted more than 170 campaign domains between February and August 2026. The ErrTraffic panel also provides geographic and referrer filtering, campaign statistics, and a WordPress plugin generator, while Cruciferra offers optional EV certificate signing and payload padding alongside its packing service.

IOCs (179)

Scan your environment for IOCs →

SHA256 FILE HASH 2

0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce

87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff

SHA1 FILE HASH 1

47d922b0fd5d704025d14ef98ded46e74830a423

MD5 FILE HASH 1

567c158ee0858f8e941d4ab7a6c18dbc

DOMAIN 174

makeverizyjar[.]info

analysis-id-fmd[.]info

analysis-id-lfg[.]info

karmactive[.]com

tzpx[.]courses

zelpx[.]garden

fingerprint-verification[.]info

verico-de-id[.]beer

msn00273[.]beer

enter-press-code[.]info

verif-key-code[.]info

id-verif-code[.]info

enter-pverif-code[.]info

enter-press-cdn[.]info

enter-code-cdn[.]info

authorization-code-cdn[.]info

authorization-id-browser[.]info

auth-id-browser[.]info

auth-code-verif[.]beer

auth-code-check[.]info

authorization-press-enter[.]info

authorization-cdn-press-enter[.]info

authorization-id-code[.]info

authorization-code[.]info

authorization-code[.]beer

codeverificatrorcl[.]info

idverification-cdn[.]info

verificationscodes[.]beer

verification-claude-cdn[.]beer

claudverification-id[.]beer

idverification-code[.]beer

codecerification[.]beer

code-verification-js[.]beer

verification-code-js[.]beer

svs-verificationdate[.]beer

cdn-verification-cloud[.]boats

verification-js-cdn[.]boats

framework-css-styles-js[.]beer

ethercdnns[.]beer

clhfgcomacdn[.]beer

ladydosug[.]love

ladydosug[.]live

ladydosug[.]top

istounscnnd[.]beer

trunnsns[.]beer

mstclaudens[.]beer

xdavnode[.]pro

hftplcnsns[.]beer

lskannsserv[.]beer

hasmeverdcdn[.]beer

claufancdn[.]beer

srtydnnc[.]beer

bhfgtrns-js[.]beer

tescdnlast[.]beer

smfcdnbb[.]beer

shssshdscn[.]beer

snccdn-framework[.]beer

testapi34726[.]sbs

nstdcs[.]beer

framework-jsoncdn[.]beer

gppcdnns[.]beer

hpscdn[.]beer

nvbfcdnclaud[.]beer

lnfcdnclad[.]beer

clainasns[.]beer

nshtjscdn[.]beer

nfstsrcdn[.]beer

gdnssljs[.]beer

biyaconserver[.]beer

npanssltejs[.]beer

bootstrup-framework-js[.]beer

nshostvps[.]beer

chekbrow[.]beer

smtnscerver[.]beer

sns-clauder-cdn[.]beer

anlytic-js-cloud[.]beer

visual-ns-portal[.]beer

slndcdnclaud[.]beer

bootstrup-cdnmaper[.]beer

nsserv-bootstru[.]beer

ns1cdnclaude[.]beer

slngftr[.]beer

travel-js-ns[.]beer

smetana-js[.]beer

mistraljs[.]beer

lsikjsns[.]beer

ssns-cdn-ns[.]beer

sane-cdn-js[.]beer

sr-hostes-js[.]beer

darndcs-js[.]beer

bkscndclou[.]beer

bcncdncl-ns[.]beer

viscdnclaud[.]beer

ldnscreatejs[.]beer

testerlau[.]lat

nfsclaudecdn[.]beer

ssjscrybootstrup[.]beer

clacndjsvulnarbi[.]beer

las-js-claud[.]beer

claudjaframework[.]beer

framesavecloudjs[.]beer

olnsclaud[.]beer

frameworkjsbns[.]beer

nsserdns[.]beer

claudesave[.]beer

nsbdnscloud[.]beer

cloude-js-server[.]beer

best-claudns-js[.]beer

awesomeisojs[.]beer

ns-claude-js[.]beer

ntsnsdns[.]beer

vjscloudjsns[.]beer

nslsconscloud[.]beer

ns-server-jscdn[.]beer

lcstdnsns[.]beer

cloudcdnginx[.]beer

bootstrap-maxcdn[.]beer

dhnsdns[.]beer

fijscdn[.]beer

bootstrup-cdn-ns[.]beer

bbdsnssserver[.]beer

lsnsdns[.]beer

fontawesome-js-cdn[.]beer

bilfojsclod[.]beer

dreff-nsdns[.]beer

vsactivens[.]beer

jsframeworkns[.]beer

nsservclod[.]beer

clnsdns[.]beer

bnnsbdsdn-js[.]beer

polygon-date[.]beer

mnoskemp[.]beer

bnsclod[.]beer

vnmstokns[.]beer

ghdnsserverns[.]beer

smnsdns[.]beer

sssndns[.]beer

vnmdnns[.]beer

neiwteamcdn[.]beer

cgfuryclaud[.]shop

exdanteam[.]beer

l3cdnns[.]beer

lenteam[.]beer

dncloteam[.]beer

sdnssmdf-js[.]beer

vsbnsbootstrup[.]beer

teamcss[.]beer

siteamnsserv[.]beer

wpteamcdn[.]beer

js-server[.]beer

lndteam[.]beer

sdhscndnssl[.]beer

stabcdnvlc[.]beer

lckcdnjs[.]beer

workcdnmass[.]beer

capcha-cdn-js[.]beer

cdn-plugin-js[.]beer

ssg-cdn[.]beer

rpc-cloud[.]beer

localcloudcss[.]sbs

cdn-yethounds[.]beer

verification-cdn-cloud[.]beer

lcates-vs[.]beer

cloud-save-image[.]sbs

virtual-cdncloud[.]sbs

winecdn[.]sbs

cdn-2faclov[.]sbs

mandare[.]life

rpc-polygon[.]beer

str-smcontrcats[.]cfd

ai-nexora[.]sbs

all-imager-hst[.]click

store-image[.]shop

nexus-server[.]click

IP ADDRESS 1

178.16.52[.]101

Detections (8)

Enable detections →

Connect your environment for suggestions and queries personalized to your security telemetry.

Browser Process Resolving a Public Blockchain RPC Endpoint
Known Sideloading Target Library Loaded From a User Writable Directory
Interactive Shell Spawning an Interpreter With a Remote Fetch Cradle
DCRCVDrv Vulnerable Kernel Driver Written to a System Temporary Directory
Kernel Driver File Written Into a System Temporary Directory
Loss of Multiple Endpoint Security Agent Processes Without a Stop or Uninstall Command
Auto-Elevating COM Server Instantiated by a Process Running From a User-Writable Path