New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code
Sekoia says the Exvicy ClickFix malware service reuses ErrTraffic code and delivers payloads via WordPress.
Sekoia's Threat Detection and Research team reported that Exvicy, a ClickFix malware-as-a-service, reuses code from rival service ErrTraffic and is already delivering malware. A Russian-speaking operator advertising as Exvicy has sold it on Exploit.in since May 26, raising the price from $1,200 to $2,000 a month by mid-August. Compromised WordPress sites inject obfuscated JavaScript that shows a fake Cloudflare Turnstile check and tells victims to press Win+R and run a PowerShell command copied to the clipboard. Sekoia found customer hosts talking to Exvicy C2 servers and about 80 panel hosts by late August; unlike ErrTraffic's EtherHiding, Exvicy hardcodes two servers.
- Exvicy is a ClickFix MaaS sold on Exploit.in since May 26, now $2,000 a month.
- Sekoia telemetry shows customer hosts contacting Exvicy C2 through compromised WordPress sites.
- Victims face a fake Cloudflare check, then Win+R runs clipboard PowerShell in 13 languages.
- Injected scripts closely match ErrTraffic; Exvicy hardcodes two C2 servers.
- Sekoia tracked about 80 hosts serving the Exvicy admin panel by late August.
Full article450 words · extracted from infosecurity-magazine.com · click to collapse
A new ClickFix malware-as-a-service (MaaS) framework called Exvicy has been built on code lifted from a rival service, ErrTraffic.
According to a technical write-up published by Sekoia's Threat Detection & Research team on September 21, telemetry from multiple customer environments showed hosts communicating with Exvicy command-and-control (C2) servers. That confirms threat actors are using it to deliver malware through compromised WordPress sites.
The seller, a Russian-speaking actor using the handle Exvicy, has advertised the MaaS on the Exploit.IN forum since May 26. It launched at $1,200 a month and rose to $2,000 in mid-August, with the operator claiming "detections are becoming daily."
When a forum user questioned the price against ErrTraffic, sold on the same forum since December 2025, the seller said his product relied on the Win+R shortcut rather than ErrTraffic's Win+X.
From a Forum Screenshot to Live Panels
Sekoia found the operator's infrastructure through a screenshot in the advert itself. A redacted domain in the admin panel still showed its length, top-level domain and Cloudflare nameserver pair, which narrowed the search to five recently registered domains.
One hosted a login page identical to the panel in the screenshot, and a PowerShell downloader there fetched a file matching one in the operator's own payload list. Pivoting from that panel turned up 13 more on July 9, and by late August Sekoia's list of hosts serving the panel ran to about 80.
The framework injects obfuscated JavaScript into compromised WordPress sites, which loads a fake Cloudflare Turnstile check. Victims are told to press Win+R, paste and press Enter, running a PowerShell command already copied to their clipboard, with instructions in 13 languages.
The page reports each step back to the operator, including when the victim clicks the fake checkbox, then polls for three minutes to confirm the command ran.
Read more: ClickFix Now Cybercriminals' Favorite Malware Delivery Technique
Near-Identical Code, One Real Difference
Sekoia assessed with high confidence that Exvicy reuses ErrTraffic's code in both the injected script and the lure page. Beyond encoded payloads and randomized variable names the injected scripts are nearly identical, and the lure pages share the same clipboard, fingerprinting, anti-analysis and polling functions.
It assessed with medium confidence that both operators use the same tool to generate the injected scripts. The clearest technical difference is not the shortcut: ErrTraffic hides its C2 address on the Polygon blockchain, a technique known as EtherHiding, while Exvicy hardcodes two servers.
Sekoia said Exvicy's developer most likely obtained ErrTraffic's source code, either as a paying customer or through a leak. Scraping the client-side code from infected sites and rebuilding the backend was less plausible since that would take as much effort as writing new code itself.