EDR Evasion

Malware, Security

The Signed Driver’s Job Was to Kill Your EDR.

A signed Windows driver crossing a trust boundary and terminating endpoint security processes before malware execution.

Cruciferra combines ClickFix delivery, a signed vulnerable driver, signed Microsoft binaries and process hollowing to disable endpoint security and deploy an infostealer.

Rob Nidschelm
29 Aug 2026