Hackers have adopted a scheme involving counterfeit CAPTCHA prompts to drop a malware suite capable of shutting down a wide array of security software before launching further attacks. The campaign uses a combination of compromised WordPress sites, fake browser verification pages, and a coercive request for victims to execute a Windows command themselves. The end result: installation of a loader named Cruciferra followed by an information stealer called Remus. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
The malicious operation is facilitated by ErrTraffic, a service that delivers malware under the guise of site verifications like Google reCAPTCHA or Cloudflare Turnstile, and even mimics Windows error messages. Visitors who interact with the fake CAPTCHA are tricked into copying a malicious PowerShell command to their clipboard. They’re prompted to launch PowerShell via keyboard shortcut, paste the copied text, and execute it. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
How the Infection Progresses
Once the victim runs the PowerShell command, the attacker uses a signed but vulnerable driver—DCRCVDrv.sys—to side-load Cruciferra through mscoree.dll. Cruciferra then employs process hollowing to embed Remus inside ServiceModelReg.exe, allowing the malware to evade detection. The initial entry points are compromised WordPress installations where attackers inject obfuscated JavaScript to deliver their lure. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
ErrTraffic also incorporates clever infrastructure agility. The service embeds smart contracts on the Polygon blockchain to retrieve its current command-and-control (C2) server, enabling rotating infrastructure without continual updates to the planted code across compromised sites. Templates and targeting filters allow affiliates to adapt the lure for Windows, Linux, or macOS systems. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
Security Impact and Recommendations
The most alarming feature of Cruciferra is its ability to use the signed driver to disable endpoint defenses. By default, the malware is set to target 145 antivirus and endpoint detection and response (EDR) processes from major vendors—Microsoft, CrowdStrike, Sophos, Kaspersky, McAfee, and others. Disabling these processes dramatically lowers a device’s security posture before more damaging activity occurs. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
To protect against this attack vector, defenders are advised to block the specific vulnerable driver by hash, ensure Microsoft’s vulnerable-driver protections are active, and look for signs of compromise like unexpected driver services or immediate PowerShell launch following clipboard events. Users should be trained to recognize that legitimate CAPTCHA challenges will never ask for running commands in PowerShell. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
Indicators of compromise have been identified, including hashes for the vulnerable driver (DCRCVDrv.sys) and the Cruciferra DLL (mscoree.dll), plus multiple domain names and one IPv4 address linked to the ErrTraffic command-and-control infrastructure. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
This campaign was discovered in late July 2026 by cybersecurity analysts, who noted the blend of polished social engineering and kernel-level driver abuse as a dangerous escalation in malware threat tactics. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-use-fake-captcha/))
With attackers deploying increasingly sophisticated methods to undermine endpoint protections, this development marks a dangerous shift. Organizations must strengthen oversight of drivers and clipboard-based scripts and never let routine verification prompts become Trojan horses. Vigilance in training, monitoring, and system hygiene is more critical than ever.
Analytically, this campaign highlights the evolving sophistication of malware, especially combining social engineering with kernel-level exploits. As attackers gain the ability to knock out major security processes stealthily, companies will need to adapt rapidly—prioritizing driver management, limiting privilege escalation, and rethinking how user prompts are used or misused. What often looks like a harmless verification step could now serve as the gateway to serious compromise.
