Hackers Use Fake CAPTCHA to Install Malware That Kills 145 Security Processes
Attackers are leveraging compromised WordPress sites and deceptive CAPTCHA pages to trick users into executing commands that disable security software, paving the way for malware deployment.
A sophisticated malware campaign is currently underway, utilizing compromised WordPress websites to distribute malicious payloads through fake CAPTCHA verification pages. This tactic, identified by researchers at eSentire, employs a service known as ErrTraffic, which crafts convincing lures mimicking familiar security checks like Google reCAPTCHA and Cloudflare Turnstile. Visitors to these compromised sites are enticed to perform actions that, unbeknownst to them, involve executing a malicious PowerShell command.
The attack chain begins with an obfuscated JavaScript injection on a legitimate, yet compromised, WordPress site. This script contacts attacker-controlled infrastructure to fetch a deceptive verification page. Instead of exploiting a browser vulnerability, the page relies on social engineering, instructing the user to copy and paste a malicious PowerShell command into their system. This command, once executed, initiates the download and installation of the Cruciferra loader.
The Cruciferra loader's primary function is to neutralize endpoint security measures before a subsequent payload, the Remus information stealer, is deployed. It achieves this by abusing a legitimate, but vulnerable, signed driver named DCRCVDrv.sys. This driver, when loaded with specific privileges, allows Cruciferra to terminate a wide array of security processes, including those from major antivirus and endpoint detection and response (EDR) solutions. Researchers have identified up to 145 security processes targeted by default, effectively blinding the system's defenses.
Following the disabling of security software, the Cruciferra loader proceeds to install the Remus information stealer. This is achieved through a process called 'process hollowing,' where the legitimate ServiceModelReg.exe process is used to host the malicious Remus stealer. The Remus stealer is designed to exfiltrate sensitive data, such as credentials and financial information, from the compromised system without detection.
Adding to the campaign's resilience, ErrTraffic leverages smart contracts on the Polygon blockchain to manage its command-and-control (C2) infrastructure. This blockchain integration allows the attackers to rotate their C2 servers dynamically, making it significantly harder for security researchers and defenders to track and block their infrastructure. The ErrTraffic service reportedly offers customization options for targeting different operating systems and tailoring lures to specific campaigns.
The technique of using a signed but vulnerable driver to disable security software is a concerning trend, often referred to as a 'Bring Your Own Vulnerable Driver' (BOVD) attack. By using a legitimate, signed driver, attackers can bypass certain security checks that might flag entirely unknown or unsigned kernel-mode components. This method highlights the ongoing cat-and-mouse game between attackers and defenders, where malicious actors continuously seek novel ways to circumvent security controls.
Security professionals are advised to remain vigilant against deceptive CAPTCHA pages that prompt users to execute commands. Blocking the identified vulnerable driver (DCRCVDrv.sys) by its hash and ensuring that Microsoft's vulnerable-driver protection mechanisms are enabled are crucial mitigation steps. Furthermore, user awareness training should emphasize that legitimate CAPTCHA challenges do not require users to interact with command-line tools like PowerShell. Detecting the Cruciferra loader, the vulnerable driver, or the associated C2 infrastructure should be treated as a potential active compromise, necessitating immediate investigation and response.