Hackers Use Fake CAPTCHA to Install Malware That Kills 145 Security Processes
Brief
Hackers are using fake CAPTCHA pages to push a malware loader that can shut down security software before a follow-on payload runs.
The campaign combines compromised WordPress websites, a familiar browser verification prompt, and a Windows command that victims are persuaded to execute themselves.
The operation uses ErrTraffic, a malware delivery service that creates ClickFix lures styled as Google reCAPTCHA, Cloudflare Turnstile, or a Windows error screen.
A visitor who follows the on-screen steps unknowingly runs a copied PowerShell command, opening the door to the Cruciferra loader and the Remus information stealer.
Analysts at eSentire said in a report shared with Cyber Security News (CSN) that they identified several ErrTraffic-generated campaigns in late July 2026.