Sekoia (Organization): news timeline & CVEs

Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites

New Exvicy MaaS uses compromised WordPress sites to deliver ClickFix lures mimicking Cloudflare Turnstile, assessed as a copycat of ErrTraffic.

A new Malware-as-a-Service (MaaS) platform named Exvicy is using compromised WordPress sites to deliver ClickFix lures. The lures mimic Cloudflare Turnstile verification pages to hijack users. Sekoia researchers assess with high confidence that Exvicy is a copycat of the ErrTraffic framework, reusing its JavaScript injection and C2 routines.

GBHackersSep 23, 12:29 UTC · 3d agoMalware 2 sources1

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

North Korea's Contagious Interview campaign hit 30,000 devices and stole about $10.71 million in crypto.

A joint advisory from agencies in Japan, the United States, Australia, and Germany says North Korean actors behind Contagious Interview, tracked in the alert as WaterPlum, compromised at least 30,000 devices in more than 100 countries. They took funds or credentials from more than 7,000 cryptocurrency wallets, estimated at $10.71 million, mainly targeting developers and Web3 specialists. Since at least 2022, operators pose as recruiters on LinkedIn, send coding tests, and deploy malware including BeaverTail, InvisibleFerret, FlexibleFerret, and OtterCookie, then use remote-access malware for persistence and data theft. Agencies also report overlap with North Korean IT-worker operations, a dismantled laptop farm in Japan, and Discord recruitment of interview proxies.

The Hacker Newsupdated Sep 22, 14:00 UTC · 4d agofirst Sep 21, 17:19 UTC · 5d agoThreat actor in the wild 5 sources1

New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code

Sekoia says the Exvicy ClickFix malware service reuses ErrTraffic code and delivers payloads via WordPress.

Sekoia's Threat Detection and Research team reported that Exvicy, a ClickFix malware-as-a-service, reuses code from rival service ErrTraffic and is already delivering malware. A Russian-speaking operator advertising as Exvicy has sold it on Exploit.in since May 26, raising the price from $1,200 to $2,000 a month by mid-August. Compromised WordPress sites inject obfuscated JavaScript that shows a fake Cloudflare Turnstile check and tells victims to press Win+R and run a PowerShell command copied to the clipboard. Sekoia found customer hosts talking to Exvicy C2 servers and about 80 panel hosts by late August; unlike ErrTraffic's EtherHiding, Exvicy hardcodes two servers.

Infosecurity Magazineupdated Sep 23, 12:29 UTC · 3d agofirst Sep 21, 14:30 UTC · 5d agoMalware in the wild 2 sources

Sekoia

Timeline3 articles

Appears with

Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code