ErrTraffic and Cruciferra subscription MaaS ecosystem outsources delivery and EDR evasion
Threat Actor Meta
Summary
Hide ▲
Show ▼
ErrTraffic and Cruciferra are being sold as subscription MaaS services, expanding the underground market for ClickFix delivery and EDR-killing capabilities. The shift lets operators rent delivery, social engineering, and defense evasion instead of building those functions in-house, increasing the speed and scale of malicious operations.
Related Happenings
Cruciferra loader EDR-killing delivery chain
Malware Activity
H score18
First: 19.08.2026 18:00
Last: 19.08.2026 18:00
Sources 1
How related:
The payload abused the signed vulnerable DCRCVDrv.sys driver to terminate security-related processes from the Windows kernel.
About this happening:
The Cruciferra loader is being used in a MaaS delivery chain that sideloads DLLs, injects Remus, and disables AV/EDR on Windows endpoints, widening malware del...
Cruciferra loader EDR-killing delivery chain
Malware ActivityHow related: The payload abused the signed vulnerable DCRCVDrv.sys driver to terminate security-related processes from the Windows kernel.
About this happening: The Cruciferra loader is being used in a MaaS delivery chain that sideloads DLLs, injects Remus, and disables AV/EDR on Windows endpoints, widening malware del...
ErrTraffic ClickFix campaign delivering Cruciferra through compromised WordPress sites
Campaign
H score32
First: 19.08.2026 18:00
Last: 19.08.2026 18:00
Sources 1
How related:
In a new advisory published earlier today, eSentire’s Threat Response Unit (TRU) described several ErrTraffic-generated ClickFix campaigns observed in late July 2026 that attempted to deliver Cruciferra.
About this happening:
An active ErrTraffic-generated ClickFix campaign is using compromised WordPress sites and clipboard-paste PowerShell lures to deliver Cruciferra, widening the malware...
ErrTraffic ClickFix campaign delivering Cruciferra through compromised WordPress sites
CampaignHow related: In a new advisory published earlier today, eSentire’s Threat Response Unit (TRU) described several ErrTraffic-generated ClickFix campaigns observed in late July 2026 that attempted to deliver Cruciferra.
About this happening: An active ErrTraffic-generated ClickFix campaign is using compromised WordPress sites and clipboard-paste PowerShell lures to deliver Cruciferra, widening the malware...
Amadey and StealC MaaS ecosystem and affiliate model
Threat Actor Meta
H score73
First: 24.06.2026 18:59
Last: 24.06.2026 18:59
Sources 1
About this happening:
The Amadey and StealC ecosystems now operate as malware-as-a-service (MaaS) offerings, widening access to loader and stealer capabilities for paying customers and affi...
Amadey and StealC MaaS ecosystem and affiliate model
Threat Actor MetaAbout this happening: The Amadey and StealC ecosystems now operate as malware-as-a-service (MaaS) offerings, widening access to loader and stealer capabilities for paying customers and affi...
DragonForce / Hackledorb pivots from RaaS to a formalized cartel structure
Threat Actor Meta
H score26
First: 18.06.2026 16:30
Last: 18.06.2026 16:30
Sources 1
About this happening:
Hackledorb has pivoted DragonForce from a conventional ransomware-as-a-service (RaaS) model into a formalized cartel structure, signaling a more organized and dura...
DragonForce / Hackledorb pivots from RaaS to a formalized cartel structure
Threat Actor MetaAbout this happening: Hackledorb has pivoted DragonForce from a conventional ransomware-as-a-service (RaaS) model into a formalized cartel structure, signaling a more organized and dura...
ClickFix multi-loader delivery campaign targeting Windows and macOS users
Campaign
H score34
First: 16.06.2026 20:41
Last: 16.06.2026 20:41
Sources 1
About this happening:
The ClickFix malware-delivery campaign is spreading BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, widening risk for Windows and macOS users across several...
ClickFix multi-loader delivery campaign targeting Windows and macOS users
CampaignAbout this happening: The ClickFix malware-delivery campaign is spreading BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, widening risk for Windows and macOS users across several...
Timeline
-
19.08.2026 18:00 2 articles · 1h ago
ErrTraffic and Cruciferra subscription services support ClickFix delivery and EDR killing
Campaign Scope UpdateeSentire’s Threat Response Unit described several ErrTraffic-generated ClickFix campaigns observed in late July 2026 that began on compromised WordPress sites and used an obfuscated ErrTraffic JavaScript injection to deliver malware while disabling endpoint security processes. ErrTraffic was advertised for $380 per month with customizable ClickFix templates, campaign statistics, filtering, and a WordPress plugin generator, while Cruciferra was sold as a $1,200-per-month loader that could kill antivirus and endpoint detection and response (EDR) processes by abusing the signed vulnerable DCRCVDrv.sys driver; eSentire said 145 process names were configured for termination by default.
Show sources
- MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra — www.infosecurity-magazine.com — 19.08.2026 18:00
- MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra — www.infosecurity-magazine.com — 19.08.2026 18:00