Fake CAPTCHA Campaign Disables Security Software with Malware Loader

Hackers are using fake CAPTCHA pages to spread malware that can disable security software on Windows devices. The campaign, called ErrTraffic, uses compromised WordPress websites and a familiar browser verification prompt to persuade victims into executing a malicious PowerShell command. This opens the door to the Cruciferra loader, which is designed to shut down endpoint protections before a follow-on payload runs.

The attack begins with an obfuscated JavaScript injection on a legitimate WordPress site that attackers have compromised. The script contacts attacker-controlled infrastructure, retrieves the lure, and presents a verification page that looks routine. However, instead of exploiting a browser flaw, the page relies on the victim completing the attacker's instructions, which includes copying a malicious PowerShell command to the clipboard and running it.

The loader then uses process hollowing to place the Remus stealer inside ServiceModelReg.exe. ErrTraffic also uses Polygon blockchain smart contracts to locate its current command server, allowing operators to rotate infrastructure without rewriting code planted across compromised sites.