An August 19 eSentire report tied several late-July 2026 fake CAPTCHA campaigns to a malware chain built to silence endpoint defenses. The immediate defender issue is DCRCVDrv.sys, a signed but vulnerable driver that the researchers said was absent from Microsoft and LOLDrivers’ known-vulnerable lists at publication. The Cruciferra loader used it to target 145 antivirus and endpoint detection and response process names before a Remus information stealer ran.
The number needs care. It describes names configured for termination, not 145 confirmed products disabled on every host. The eSentire TRU reported several ErrTraffic campaigns, but it did not quantify affected sites, visitors, infections, or organizations. The research comes from a managed security vendor and its report promotes eSentire services; the technical analysis concerns third-party malware rather than an evaluation of eSentire’s own product.
A Fake Check Starts PowerShell
The intrusion begins after an attacker compromises a WordPress site and adds an obfuscated ErrTraffic script. That script asks a Polygon smart contract for the current command server, retrieves a lure, and presents a page styled as Google reCAPTCHA, Cloudflare Turnstile, or a Windows error.
The page copies a PowerShell command to the visitor’s clipboard. It then tells the visitor to open PowerShell, paste the command, and execute it. This step exploits trust and urgency. The research does not describe a flaw in WordPress, Google reCAPTCHA, Cloudflare Turnstile, or the browser as the means of execution.
Later PowerShell stages use a legitimate Microsoft-signed program to side-load mscoree.dll, the Cruciferra payload. Cruciferra hollows the signed ServiceModelReg.exe process and places the Remus stealer inside it. Remus is a downloaded follow-on payload in the reported chain; the source establishes its execution inside the hollowed process.
Cruciferra Reaches The Kernel
Cruciferra’s endpoint-security killer uses DCRCVDrv.sys, a driver signed by South Korean software company MocoMsys. The driver exposes an input/output control request that lets a user-mode program ask the Windows kernel to terminate a process.
That is the leverage Cruciferra needs. With its UAC-bypass and EDR-killer options enabled, the loader writes the driver, creates a service, and matches running processes against its configured list. eSentire’s TRU wrote that the sample “terminates 145 AV/EDR-related processes.” The list spans products from Microsoft, CrowdStrike, SentinelOne, Sophos, Kaspersky, McAfee, Bitdefender, Carbon Black, and others.
The driver technique is often called bring your own vulnerable driver. A valid signature can help a driver appear trustworthy even when its exposed kernel operation is dangerous. eSentire said the specific driver was unknown to Microsoft and LOLDrivers when the report was published. Generic vulnerable-driver controls therefore need a measured test against this file.
The report names no fixed MocoMsys driver version, superseding driver, or Windows build that resolves this exposure. Its defensive path is to identify and block the published file while verifying that the deployed driver policy produces a deny event.
Figure description
A compromised WordPress site loads an ErrTraffic script. The script resolves rotating command infrastructure through a Polygon smart contract and displays a fake verification prompt. The visitor pastes a PowerShell command, which starts signed-binary side-loading of Cruciferra. Cruciferra loads DCRCVDrv.sys to request kernel termination of security processes while Remus executes inside ServiceModelReg.exe.
The Kill List Is Conditional
The report supports a serious capability and an observed delivery campaign. It does not establish that every ErrTraffic visit produced an infection or that every Cruciferra build used the kernel feature. The UAC-bypass and EDR-killer options have to be enabled in the malware configuration.
The 145 entries are also process-name targets. They are useful for understanding the loader’s intent, while they do not prove 145 successful terminations on one device. An endpoint could have a subset of those processes, a control could block the driver, or the visitor could stop before running the command.
No response from Microsoft, MocoMsys, WordPress, Google, or Cloudflare appears in the primary report. Google and Cloudflare brands were impersonated in lure templates. Polygon infrastructure was used as a legitimate shared service for dead-drop command discovery, so its public RPC hostnames should remain ordinary hostnames in telemetry rather than being treated as attacker-owned infrastructure.
Trace The Full Sequence
Defenders can recognize this chain before remediation by correlating browser activity on an unexpected verification page with clipboard use and a new PowerShell process. Continue through signed-binary DLL side-loading, a new driver service, DCRCVDrv.sys, mscoree.dll, and ServiceModelReg.exe receiving injected code. Preserve process creation, PowerShell script-block, driver-load, service-creation, DNS, proxy, and browser history before isolation removes volatile context.
Search for these published file hashes:
DCRCVDrv.sysSHA-256:87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff- Cruciferra
mscoree.dllSHA-256:0ae0a7f118b80e4655b8b86bb421c151a8f17930e76e714b2fa199409f3af9ce
The campaign indicators are makeverizyjar[.]info and analysis-id-fmd[.]info for ErrTraffic command traffic; tzpx[.]courses and zelpx[.]garden for Remus command traffic; and 178.16.52[.]101 for ErrTraffic infrastructure. karmactive[.]com was a compromised WordPress site, so treat it as an incident-era indicator rather than attacker-owned infrastructure.
ErrTraffic also queried Polygon smart contracts 0xB6BC9E1D0B2FB96AB7C47E04CB0BE477410BC1F2 and 0x83833C5D676CA06E941A32310AE67D0890F657EE. The report observed these legitimate Polygon RPC endpoints in the resolution list: polygon.drpc.org, polygon-mainnet.gateway.tatum.io, polygon.rpc.subquery.network/public, polygon.lava.build, 1rpc.io/matic, polygon-public.nodies.app, polygon.rpc.hypersync.xyz, rpc-mainnet.matic.quiknode.pro, gateway.tenderly.co/public/polygon, polygon.therpc.io, polygon.gateway.tenderly.co, polygon-mainnet.public.blastapi.io, rpc.ankr.com/polygon, and polygon-bor-rpc.publicnode.com. A match becomes useful when it aligns with the rest of the process and browser sequence.
Test The Driver Block
Add both hashes to endpoint searches and block policy, then run a controlled validation using the DCRCVDrv.sys hash against every supported Windows control stack. Confirm that driver-load telemetry records a deny event and that no new service remains registered. The expected result is a blocked load with a retained alert that identifies the host, user, parent process, file path, hash, and policy responsible for the denial.
If the driver loaded, isolate the host, preserve volatile evidence, and scope the earlier ClickFix and PowerShell activity before trusting a quiet endpoint console. A terminated sensor can remove the very telemetry that would otherwise make the infection obvious.