New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code
Sekoia says the Exvicy ClickFix malware service reuses ErrTraffic code and delivers payloads via WordPress.
Sekoia's Threat Detection and Research team reported that Exvicy, a ClickFix malware-as-a-service, reuses code from rival service ErrTraffic and is already delivering malware. A Russian-speaking operator advertising as Exvicy has sold it on Exploit.in since May 26, raising the price from $1,200 to $2,000 a month by mid-August. Compromised WordPress sites inject obfuscated JavaScript that shows a fake Cloudflare Turnstile check and tells victims to press Win+R and run a PowerShell command copied to the clipboard. Sekoia found customer hosts talking to Exvicy C2 servers and about 80 panel hosts by late August; unlike ErrTraffic's EtherHiding, Exvicy hardcodes two servers.
- Exvicy is a ClickFix MaaS sold on Exploit.in since May 26, now $2,000 a month.
- Sekoia telemetry shows customer hosts contacting Exvicy C2 through compromised WordPress sites.
- Victims face a fake Cloudflare check, then Win+R runs clipboard PowerShell in 13 languages.
- Injected scripts closely match ErrTraffic; Exvicy hardcodes two C2 servers.
- Sekoia tracked about 80 hosts serving the Exvicy admin panel by late August.
- ATT&CK
- T1189 Drive-by CompromiseT1204 User ExecutionT1059.001 PowerShellT1027 Obfuscated Files or Information
- Products
- WordPress
- Threat actors
- Exvicy
- Malware
- ExvicyErrTraffic
- Organizations
- Sekoia
From the original article
2 min read at infosecurity-magazine.com
Sekoia said Exvicy, a new ClickFix MaaS framework, reused code from rival service ErrTraffic
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.