The Rise of EDR-Killing Loaders: Analyzing Cruciferra and the ClickFix Delivery Ecosystem

Executive Summary

As of August 27, 2026, the Encrygma Threat Intel Unit has observed a critical convergence between sophisticated social engineering delivery methods and kernel-level defense neutralization tools. The primary development is the emergence of the Cruciferra malware loader, a specialized 'EDR-killer' currently being distributed via ClickFix campaigns. Cruciferra utilizes the 'Bring Your Own Vulnerable Driver' (BYOVD) technique to gain kernel-level privileges, allowing it to terminate 145 distinct security-related processes. This report also highlights the expansion of ClickFix to macOS via the Odyssey Stealer and the technical evolution of the Griffith intrusion set, which has transitioned from Visual Basic 6 to C++ implants. These findings suggest that the 'exploit window' is collapsing as attackers utilize automated tools to weaponize vulnerabilities and neutralize defenses in near real-time.

Background & Context

Throughout the first half of 2026, threat actors have increasingly focused on bypassing Endpoint Detection and Response (EDR) systems, which have become standard in enterprise environments. Traditional obfuscation and fileless execution are no longer sufficient against modern behavioral heuristics. Consequently, the underground market has seen a rise in 'EDR-Killers'—tools specifically designed to blind security software before the primary payload is executed.

In the last 72 hours, reporting from Cruciferra Malware Loader Kills EDR via ClickFix and Odyssey Stealer Malware Attacks macOS Users confirms that these tools are being paired with highly effective delivery mechanisms. The 'ClickFix' technique, which tricks users into executing malicious PowerShell or Terminal commands under the guise of fixing a browser error or CAPTCHA, has become the preferred initial access vector for several high-profile malware families, including the newly identified Cruciferra and Odyssey Stealer.

Analysis

The Cruciferra Mechanism: Kernel-Level Neutralization

Cruciferra is a Malware-as-a-Service (MaaS) product sold for approximately $1,200 per month. Its primary value proposition is its ability to 'kill' 145 different antivirus (AV) and EDR processes. It achieves this by loading a signed but vulnerable driver—a technique known as BYOVD. Because the driver is legitimately signed by a trusted authority, it bypasses Windows Driver Signature Enforcement (DSE). Once loaded, the malware exploits a vulnerability within the driver to execute code with kernel privileges (Ring 0), where it can directly terminate the protected processes of security software that would otherwise be untouchable from user mode (Ring 3).

This campaign is often facilitated by the ErrTraffic delivery service, operated by an actor known as 'LenAI'. The integration of ErrTraffic's ClickFix templates with Cruciferra's EDR-killing capabilities demonstrates a modular and highly professionalized supply chain in the cybercrime underground.

ClickFix Evolution: From Windows to macOS

While ClickFix was initially a Windows-centric threat, the discovery of Odyssey Stealer on August 25, 2026, confirms the technique's successful porting to macOS. In these attacks, users visiting compromised sites are presented with a fake 'Google Chrome Update' or 'CAPTCHA Verification' window. The prompt instructs the user to copy a 'fix' code and paste it into their Terminal. This 'fix' is actually a base64-encoded command that downloads and executes the Odyssey Stealer. This bypasses traditional browser-based security warnings because the user is the one initiating the execution, effectively 'self-infecting' through a trusted system utility.

The Griffith Intrusion Set: Technical Maturation

Parallel to the loader developments, the Griffith intrusion set (targeting fintech and iGaming) has shown significant reverse engineering findings. According to Virus Bulletin :: What cybersecurity experts are talking about in 2026, the group has moved from the VB6-based DarkMe malware to a more robust C++ implant dubbed GriffithRAT. This new implant includes a custom-developed remote-desktop controller, keylogger, and file-grabber. The shift to C++ allows for better performance, smaller footprints, and more complex persistence mechanisms, indicating a long-term investment in their custom toolset.

Platform Abuse: Steam Workshop and Wallpaper Engine

On August 27, 2026, researchers identified a new campaign abusing the Steam Workshop to distribute malware via the Wallpaper Engine application. Attackers upload malicious 'wallpapers' that contain embedded scripts. When a user subscribes to the wallpaper, the application automatically downloads the content, which then executes a payload—often the Yogi malware. This highlights a growing trend of 'Living off the App' (LotApp), where attackers abuse the update and plugin mechanisms of trusted, popular software to bypass perimeter defenses.

Key Findings

• EDR Termination as a Service: Cruciferra's ability to terminate 145 security processes via BYOVD represents a high-tier threat to enterprise visibility.
• Social Engineering Sophistication: The ClickFix technique leverages 'copy-paste' commands to bypass browser sandboxes and security warnings by involving the user in the execution chain.
• Cross-Platform Parity: macOS is no longer a secondary target; Odyssey Stealer proves that ClickFix is equally effective against Apple's ecosystem.
• Modular Cybercrime: The partnership between ErrTraffic (delivery) and Cruciferra (loader) illustrates a mature, specialized ecosystem where actors rent specific components of an attack.
• Trusted Platform Abuse: The use of Steam Workshop for malware delivery exploits the implicit trust users place in large, legitimate content ecosystems.

Attribution & Confidence

• Cruciferra/ErrTraffic: We attribute the delivery of Cruciferra to the ErrTraffic service, operated by the actor LenAI, with high confidence. The loader itself is a commercial product available on top-tier Russian-speaking forums.
• Griffith Intrusion Set: We attribute the GriffithRAT and DarkMe activity to a persistent threat actor targeting the financial sector, with moderate confidence that this group is financially motivated rather than state-sponsored, despite their high level of technical sophistication.
• Odyssey Stealer: Attribution remains ongoing, but the TTPs (Tactics, Techniques, and Procedures) overlap significantly with previous 'ClearFake' and 'ClickFix' operators.

Defensive Recommendations

1. Implement Driver Blocklists: Organizations should enable Microsoft's vulnerable driver blocklist or use third-party tools to prevent the loading of known vulnerable drivers used in BYOVD attacks.
2. Restrict PowerShell and Terminal: Use Constrained Language Mode for PowerShell and monitor for unusual parent-child process relationships (e.g., a browser launching powershell.exe or Terminal).
3. User Education on 'Copy-Paste' Attacks: Train employees to recognize the 'ClickFix' pattern. Legitimate software updates or CAPTCHAs will never require a user to copy and paste code into a command-line interface.
4. Endpoint Hardening: Enable 'Block abuse of exploited vulnerable signed drivers' in Windows Defender Exploit Protection settings.
5. Monitor Trusted App Traffic: Inspect traffic and file writes from applications like Steam or Wallpaper Engine, which may be used as conduits for malicious content.

Outlook

The remainder of 2026 will likely see a continued 'arms race' at the kernel level. As EDR vendors patch the vulnerabilities exploited by loaders like Cruciferra, attackers will leverage AI-driven vulnerability research to find new 'zero-day' drivers to facilitate BYOVD. The 'collapsing exploit window'—where vulnerabilities are weaponized in minutes—means that reactive patching is no longer sufficient. The industry must move toward 'Zero Trust' at the hardware and driver level, ensuring that only explicitly authorized code can interact with the kernel, regardless of its signature status.