Hackers Use Fake CAPTCHA to Install Malware That Kills 145 Security Processes

Hackers are using fake CAPTCHA pages to push a malware loader that can shut down security software before a follow-on payload runs.

The campaign combines compromised WordPress websites, a familiar browser verification prompt, and a Windows command that victims are persuaded to execute themselves.

The operation uses ErrTraffic, a malware delivery service that creates ClickFix lures styled as Google reCAPTCHA, Cloudflare Turnstile, or a Windows error screen.

A visitor who follows the on-screen steps unknowingly runs a copied PowerShell command, opening the door to the Cruciferra loader and the Remus information stealer.

Analysts at eSentire said in a report shared with Cyber Security News (CSN) that they identified several ErrTraffic-generated campaigns in late July 2026.

The finding shows how attackers combine polished social engineering with a kernel-level method for disabling endpoint protections.

The impact is serious because Cruciferra is designed to blind a device before more harmful activity begins. It abuses a signed but vulnerable driver to terminate selected antivirus and endpoint detection processes, reducing the chance that the next stage will be stopped or reported.

Hackers Use Fake CAPTCHA

The attack begins on a legitimate WordPress site that attackers have already compromised. An obfuscated JavaScript injection contacts attacker-controlled infrastructure, retrieves the lure, and presents a verification page that looks routine.

Rather than exploiting a browser flaw, the page relies on a person completing the attacker’s instructions. It copies a malicious PowerShell command to the clipboard and asks the visitor to open PowerShell with Windows Key plus X, paste the command, and run it.

Subsequent PowerShell stages use a legitimate Microsoft-signed program to side-load Cruciferra as mscoree.dll.

The loader then uses process hollowing to place the Remus stealer inside ServiceModelReg.exe. Similar malicious WordPress script injections show why website owners must watch for unauthorized changes.

ErrTraffic also uses Polygon blockchain smart contracts to locate its current command server. That design lets operators rotate infrastructure without rewriting the code planted across compromised sites.

The service reportedly offers targeting filters and templates for Windows, Linux, and macOS, allowing affiliates to tailor a lure to the visitor and campaign.

The deception follows a broader pattern seen in fake CAPTCHA ClickFix campaigns, where attackers turn a familiar verification prompt into a malware delivery channel. Users should be cautious whenever a website asks them to paste text into a Windows tool to complete a CAPTCHA.

Driver Abuse Silences Defenses

Cruciferra’s most concerning feature is its ability to load DCRCVDrv.sys, a signed driver with a weakness that lets software request process termination from the Windows kernel.

When the loader is configured with its privilege-bypass and security-killing options, it writes the driver to the Windows Temp directory, creates a service, and begins targeting defenses.

Researchers found 145 antivirus and EDR-related process names configured by default. The list includes products from Microsoft, CrowdStrike, SentinelOne, Sophos, Kaspersky, McAfee, and others.

Killing these processes can remove valuable warning and containment controls before attackers steal data, spread through a network, or deploy additional malware.

This is a bring-your-own-vulnerable-driver technique, in which attackers use a real signed driver rather than an obviously malicious kernel component.

It reflects the same risk covered in reporting on driver attacks against EDR, where a vulnerable driver can give malware the leverage to neutralize security software.

Defenders should block the identified driver by hash in their security console and keep Microsoft’s vulnerable-driver protections enabled. Teams should also investigate unexpected driver services, browser pages that demand keyboard shortcuts, and PowerShell started immediately after clipboard activity.

User awareness training should make clear that real CAPTCHA checks do not ask people to paste commands into Windows. Organizations should treat a detection of the loader, driver, or listed network infrastructure as a possible active compromise.

Monitoring for malware disables endpoint defenses is important because loss of visibility may be the attacker’s first objective.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff	Vulnerable DCRCVDrv.sys driver
SHA-1	47d922b0fd5d704025d14ef98ded46e74830a423	Vulnerable DCRCVDrv.sys driver
MD5	567c158ee0858f8e941d4ab7a6c18dbc	Vulnerable DCRCVDrv.sys driver
SHA-256	0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce	Cruciferra DLL, mscoree.dll
Domain	makeverizyjar[.]info	ErrTraffic command-and-control server
Domain	analysis-id-fmd[.]info	ErrTraffic command-and-control server
Domain	analysis-id-lfg[.]info	ErrTraffic command-and-control server
IPv4	178.16.52[.]101	ErrTraffic command-and-control server
Domain	karmactive[.]com	Compromised WordPress site hosting an ErrTraffic injection
Domain	tzpx[.]courses	Remus command-and-control server
Domain	zelpx[.]garden	Remus command-and-control server

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC