Exvicy (Malware): news timeline & CVEs

Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites

New Exvicy MaaS uses compromised WordPress sites to deliver ClickFix lures mimicking Cloudflare Turnstile, assessed as a copycat of ErrTraffic.

A new Malware-as-a-Service (MaaS) platform named Exvicy is using compromised WordPress sites to deliver ClickFix lures. The lures mimic Cloudflare Turnstile verification pages to hijack users. Sekoia researchers assess with high confidence that Exvicy is a copycat of the ErrTraffic framework, reusing its JavaScript injection and C2 routines.

GBHackersSep 23, 12:29 UTC · 3d agoMalware 2 sources1

New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code

Sekoia says the Exvicy ClickFix malware service reuses ErrTraffic code and delivers payloads via WordPress.

Sekoia's Threat Detection and Research team reported that Exvicy, a ClickFix malware-as-a-service, reuses code from rival service ErrTraffic and is already delivering malware. A Russian-speaking operator advertising as Exvicy has sold it on Exploit.in since May 26, raising the price from $1,200 to $2,000 a month by mid-August. Compromised WordPress sites inject obfuscated JavaScript that shows a fake Cloudflare Turnstile check and tells victims to press Win+R and run a PowerShell command copied to the clipboard. Sekoia found customer hosts talking to Exvicy C2 servers and about 80 panel hosts by late August; unlike ErrTraffic's EtherHiding, Exvicy hardcodes two servers.

Infosecurity Magazineupdated Sep 23, 12:29 UTC · 3d agofirst Sep 21, 14:30 UTC · 5d agoMalware in the wild 2 sources

Exvicy

Timeline2 articles

Appears with

Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites

New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code