Fake CAPTCHA Installs Malware That Kills 145 Security Processes

Key Takeaways

• A new malware campaign leverages fake CAPTCHA pages to deploy the Cruciferra loader and Remus information stealer.
• The attack chain begins on compromised WordPress sites, tricking users into executing malicious PowerShell commands.
• Cruciferra utilizes a vulnerable, signed driver (DCRCVDrv.sys) to disable 145 different antivirus and EDR processes, including those from major vendors like Microsoft, CrowdStrike, and SentinelOne.
• This tactic, known as “bring-your-own-vulnerable-driver,” aims to blind security defenses before further malicious activity, such as data exfiltration or network spread.
• The campaign, identified by eSentire in late July 2026, highlights a growing trend of combining sophisticated social engineering with kernel-level defense evasion.

Fake CAPTCHA Lures Deliver Potent Malware Duo

Cyber attackers are deploying a dangerous new campaign that uses deceptive CAPTCHA pages to install a malware loader capable of neutralizing endpoint security software before subsequent payloads are executed. This sophisticated operation combines compromised WordPress websites, convincing browser verification prompts, and a cunning social engineering tactic that persuades victims to manually run a Windows command.

The campaign centers on ErrTraffic, a malware delivery service that generates “ClickFix” lures masquerading as legitimate Google reCAPTCHA, Cloudflare Turnstile, or even Windows error screens. Unsuspecting visitors who follow the on-screen instructions inadvertently execute a malicious PowerShell command, which paves the way for the Cruciferra loader and the Remus information stealer.

Analysts at eSentire said in a report that they uncovered multiple ErrTraffic-generated campaigns in late July 2026. This discovery underscores how threat actors are merging polished social engineering techniques with kernel-level methods to bypass and disable endpoint protection mechanisms.

How the Attack Unfolds

The attack sequence initiates on a legitimate WordPress website that has been previously compromised by the attackers. An obfuscated JavaScript injection contacts the attacker’s infrastructure, retrieves the malicious lure, and presents a seemingly routine verification page.

Instead of exploiting a browser vulnerability, the page relies on the user’s unwitting cooperation. It copies a malicious PowerShell command to the clipboard and instructs the visitor to open PowerShell using the Windows Key + X shortcut, paste the command, and execute it. Subsequent PowerShell stages then leverage a legitimate Microsoft-signed program to side-load Cruciferra as mscoree.dll. The loader proceeds to use process hollowing to inject the Remus stealer into ServiceModelReg.exe. This method of malicious WordPress script injection reinforces the critical need for website administrators to vigilantly monitor for unauthorized alterations.

ErrTraffic further enhances its resilience by utilizing Polygon blockchain smart contracts to dynamically locate its current command-and-control server. This innovative design allows operators to rotate their infrastructure without needing to rewrite or update the malicious code embedded across various compromised sites. The service reportedly offers advanced targeting filters and templates for Windows, Linux, and macOS, enabling affiliates to customize lures for specific visitors and campaigns. This deception mirrors a broader pattern observed in fake CAPTCHA ClickFix campaigns, where a familiar verification prompt is weaponized as a malware delivery mechanism. Users must exercise extreme caution if a website ever prompts them to paste text into a Windows utility to complete a CAPTCHA challenge.

Driver Abuse Silences Defenses

The most alarming aspect of Cruciferra is its capability to load DCRCVDrv.sys, a legitimately signed driver containing a known vulnerability. This flaw allows software to request process termination directly from the Windows kernel. When the loader is configured with its privilege-bypass and security-killing options, it writes this vulnerable driver to the Windows Temp directory, creates a service, and then systematically begins targeting security defenses.

Researchers discovered that Cruciferra is pre-configured to target 145 different antivirus and EDR-related process names by default. This extensive list includes products from leading security vendors such as Microsoft, CrowdStrike, SentinelOne, Sophos, Kaspersky, and McAfee. Terminating these critical processes can effectively remove vital warning and containment controls, leaving a device vulnerable before attackers can exfiltrate data, propagate through a network, or deploy additional malicious payloads.

This technique is a prime example of a “bring-your-own-vulnerable-driver” attack, where threat actors exploit a real, signed driver rather than an overtly malicious kernel component. It mirrors the risks highlighted in previous reporting on driver attacks against EDR, where a compromised or vulnerable driver can grant malware the necessary privileges to neutralize security software.

What You Should Do

• Block Identified Drivers: Implement blocks for the identified vulnerable driver (DCRCVDrv.sys) by its hash in your security consoles and endpoint protection solutions.
• Enable Microsoft Vulnerable Driver Protections: Ensure that Microsoft’s built-in protections against vulnerable drivers are enabled and actively enforced across your environment.
• Monitor for Anomalous Activity: Investigate any unexpected driver services, browser pages demanding keyboard shortcuts for verification, and PowerShell processes initiated immediately after clipboard activity.
• Conduct User Awareness Training: Educate users that legitimate CAPTCHA checks will never ask them to paste commands into Windows utilities. Emphasize the dangers of executing untrusted commands.
• Treat Detections as Compromise: Any detection of the Cruciferra loader, the DCRCVDrv.sys driver, or the listed command-and-control infrastructure should be treated as a strong indicator of an active compromise.
• Prioritize Endpoint Visibility: Continuously monitor for any signs of malware attempting to disable endpoint defenses, as loss of visibility is often an attacker’s primary objective.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.