Malware campaign combines ClickFix, ErrTraffic and Cruciferra techniques

Infosecurity Magazine reports that cybersecurity firm eSentire has uncovered a coordinated malware-as-a-service campaign that combines ClickFix social engineering lures with ErrTraffic and Cruciferra malware delivery techniques. The campaign uses fake error messages and system prompts to trick users into executing malicious code, often disguised as legitimate troubleshooting steps or software updates. eSentire's research shows that the attackers are using a modular approach, combining multiple well-established attack techniques into a single campaign that can adapt to different targets and environments. The malware-as-a-service model means that the infrastructure and techniques are being sold or rented to multiple threat actors, increasing the scale and reach of the campaign across different sectors and geographies.

Why this matters for UK organisations

For UK businesses, this type of coordinated, modular malware campaign represents a practical challenge for detection and response. The use of social engineering lures that mimic legitimate system messages makes it harder for users to distinguish between genuine prompts and malicious ones, and the combination of multiple techniques in a single campaign can bypass security controls that are designed to detect individual attack methods in isolation. The malware-as-a-service model also means that the same infrastructure and techniques may be used by different threat actors with different objectives, making attribution and pattern recognition more difficult. Organisations need to ensure that security awareness training reflects the current state of social engineering tactics, and that endpoint detection and response tools are capable of identifying behaviour patterns rather than relying solely on signature-based detection. The modular nature of the campaign also means that organisations may see different stages of the attack chain at different times, requiring security teams to correlate events across multiple systems and timeframes.

What to review

Security awareness training should be reviewed to ensure it includes examples of current social engineering techniques, particularly fake error messages and system prompts that instruct users to take specific actions such as running commands, downloading files or disabling security controls. IT teams should verify that endpoint protection tools are configured to detect and block suspicious script execution, particularly PowerShell, command line activity or other scripting environments that may be used to deliver malware. Email security controls should be reviewed to ensure they are capable of identifying malicious links and attachments that use these techniques, and that URL filtering and sandboxing are configured to detect multi-stage delivery mechanisms. Organisations should also consider whether incident response playbooks account for multi-stage attacks that combine social engineering with malware delivery, and whether security monitoring includes behavioural detection rather than relying solely on known indicators of compromise. Security teams should ensure that endpoint detection and response tools are configured to alert on suspicious behaviour patterns, and that security operations teams have the visibility and context needed to correlate events across multiple systems and identify coordinated campaigns.

Source: Infosecurity Magazine