A recent malware-as-a-service (MaaS) campaign has combined ClickFix social engineering with the ErrTraffic delivery service and Cruciferra loader. This coordination allows cybercriminals to distribute malware effectively while circumventing endpoint security. The campaign utilizes compromised WordPress sites, with a JavaScript injection that resolves to a command-and-control address.
Notably, Cruciferra is designed to disable security processes using a vulnerable driver, enabling the injection of an information stealer. The combination of these services showcases a trend where attackers outsource different parts of the attack process, enhancing efficiency and evasion tactics.