Skip to navigation

Threat reportThreat IntelligenceTL-2026-5785

QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)

highMONITORING

QuoIntelligence's Week 39 2026 snapshot (17-23 September 2026) highlights four concurrent threats: the Exvicy ClickFix MaaS framework copying ErrTraffic and spreading lures via compromised WordPress sites; the Graphalgo campaign delivering a Go RAT through malicious Terraform providers and Go modules; the RemControl Android banking trojan targeting retail banking customers in Europe, the Middle East and Canada; and Nightmare Eclipse's BigDiskBuster exploit that stops Microsoft Defender from updating. First disclosed .

Key facts

IdentifiersTL-2026-5785
Also known asThreat Intelligence Snapshot W39 2026, BigDiskBuster, ErrTraffic copycat
SeverityHIGH
First disclosed
Affected productsMicrosoft Windows Defender / Microsoft Defender Antivirus; HashiCorp Terraform Registry providers; Go ecosystem Go modules; WordPress Compromised WordPress sites; Google Android
MalwareRemControl
ToolsErrTraffic, Exvicy
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1059 Command and Scripting Interpreter, T1082 System Information Discovery, T1195 Supply Chain Compromise, T1204 User Execution, T1417 Input Capture, T1513 Screen Capture, T1583 Acquire Infrastructure
MotivationFINANCIAL
Target sectorsfinance, government administration, health, technology, industrial, real-estate, consumer
Target regionsEurope, North America, Middle East, Global
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5785 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Win+R PowerShell Paste-and-Run (Exvicy/ErrTraffic) — Exploitation

Detects PowerShell spawned by explorer.exe with download, encoded or hidden-window arguments and a long command line, the behavioural footprint of Exvicy/ErrTraffic ClickFix lures (fake Cloudflare Turnstile Security Check on compromised WordPress sites instructing the victim to press Win+R, paste and Enter). Behaviour-first: it does not depend on the operator's hardcoded servers, so it survives infrastructure rotation. Tracked under TL-2026-5785 (MITRE T1204, T1059, T1027, T1189).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204, T1059, T1027, T1189
  • Data sources: sysmon, windows_security, defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*iex *" OR CommandLine="*Invoke-Expression*" OR CommandLine="*iwr *" OR CommandLine="*irm *" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*DownloadString*" OR CommandLine="*FromBase64String*" OR CommandLine="* -enc *" OR CommandLine="*-EncodedCommand*" OR CommandLine="*-w hidden*" OR CommandLine="*-WindowStyle Hidden*")
```Exvicy/ErrTraffic ClickFix: victim pastes a clipboard-loaded PowerShell one-liner into Win+R, so the shell is parented by explorer.exe```
| eval cmd_len=len(CommandLine)
| where cmd_len>80
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
// Exvicy / ErrTraffic ClickFix: Win+R paste-and-run is parented by explorer.exe
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where strlen(ProcessCommandLine) > 80
| where ProcessCommandLine has_any ("iex ", "Invoke-Expression", "iwr ", "irm ", "Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "FromBase64String", " -enc ", "-EncodedCommand", "-w hidden", "-WindowStyle Hidden")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Sigma

title: ClickFix Win+R PowerShell Paste-and-Run (Exvicy / ErrTraffic)
id: 3b7e1c52-8d4a-4f6e-9a21-5c0d7e8f1a01
status: experimental
description: Detects PowerShell launched directly by explorer.exe with download, encoded or hidden-window arguments, the process pattern left when a victim pastes a clipboard-loaded command into the Win+R Run dialog after an Exvicy or ErrTraffic fake Cloudflare Turnstile Security Check lure.
references:
    - https://quointelligence.eu/2026/09/threat-intelligence-snapshot-week-39-2026/
    - https://www.aikido.dev/blog/graphalgo-terraform-go-modules
    - https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
    - https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.execution
    - attack.t1204
    - attack.t1059
    - attack.defense-evasion
    - attack.t1027
    - attack.initial-access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd:
        CommandLine|contains:
            - 'iex '
            - 'Invoke-Expression'
            - 'iwr '
            - 'irm '
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadString'
            - 'FromBase64String'
            - ' -enc '
            - '-EncodedCommand'
            - '-w hidden'
            - '-WindowStyle Hidden'
    condition: all of selection_*
falsepositives:
    - Administrators or helpdesk staff manually pasting a PowerShell download one-liner into the Run dialog
    - Software deployment or onboarding snippets launched interactively from the desktop
level: high

Known false positives:

  • Administrators or helpdesk staff pasting a PowerShell download one-liner into the Run dialog
  • Interactive software-install or onboarding snippets launched from the desktop shell

Tuning notes: Requires Sysmon EventCode 1 in index=sysmon (adjust index/sourcetype to your environment). Raise cmd_len above 80 or exclude known admin accounts and vetted internal script hosts via User. Pair with a RunMRU registry-write detection (Explorer RunMRU values containing powershell) to catch the Run dialog directly. The Exvicy hardcoded C2 servers are not published in the research, so add them as IOCs when available.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Graphalgo Malicious Terraform Provider / Go Module Usage — Exploitation (Supply Chain) · unlock with TL Creds
  • BigDiskBuster Defender Update DoS (Nightmare Eclipse) — Post-Exploitation · unlock with TL Creds
  • RemControl Android Banker C2, Operator Panel and Telegram Dead Drop — C2 · unlock with TL Creds
  • RemControl Android Banker Distribution via Fake TVTap Sites — Exploitation · unlock with TL Creds
  • Graphalgo Disguised ZIP Payload Files and Package Cache Writes — Post-Exploitation · unlock with TL Creds
  • Graphalgo Actor Domains DNS Resolution — C2 · unlock with TL Creds
  • Graphalgo Go RAT Execution via Terraform Provider and go run — Post-Exploitation · unlock with TL Creds
  • Graphalgo Go RAT C2 via Slack Workspaces and Arbitrum Sepolia Dead Drop — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5785.

Sample indicators (3 of 30)

  • IP address: 193.247.144[.]38
  • Domain: gocommunity[.]io
  • URL: hxxps://tvtap-liveapp[.]com/dl.php

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

This record consolidates the four headline items in QuoIntelligence's Threat Intelligence Snapshot for Week 39, 2026 (published 2026-09-24). The snapshot itself is headline-level only (full write-ups are gated); technical detail below is taken from the primary vendor research for each item and is attributed accordingly.

Exvicy / ErrTraffic (ClickFix): Sekoia (21 Sep 2026) assessed with high confidence that Exvicy, a malware-as-a-service ClickFix framework advertised on Exploit.IN since 26 May 2026 (price rising from $1,200 to $2,000 per month), reuses ErrTraffic's code in both the injected script and the lure page. Obfuscated JavaScript injected into compromised WordPress sites builds a full-screen 'Security Check' iframe presenting a fake Cloudflare Turnstile check in 13 languages. Victims are instructed to press Win+R, paste a clipboard-loaded PowerShell command and press Enter; the lure page reports each step to the operator and polls for three minutes to confirm execution. Unlike ErrTraffic, which hides C2 addresses on the Polygon blockchain (EtherHiding), Exvicy hardcodes two servers. About 80 hosts served the operator panel by late August 2026.

Graphalgo (Go RAT supply chain): Aikido (22 Sep 2026, updated 24 Sep) reported the first observed malware distribution through Terraform providers. Two Terraform Registry providers (gocommunity-io/dockerd, and kreuzwenker/docker typosquatting kreuzwerker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) carry a Go port of the Graphalgo implant. The provider payload stays inert unless the SHA-256 of the runtime containerName and networkID values matches a hardcoded hash, which doubles as an AES key to decrypt an embedded ZIP that is run via a detached 'go run .'. btreex hid the payload in an encrypted ZIP disguised as btreex.sql and used forged commits to backdate history to November 2025 so the Go proxy showed a false release date. The RAT checks in with platform, hostname, username, home directory and Node.js availability, and uses two C2 channels: Slack (polling every 10 seconds) and an Arbitrum Sepolia smart contract dead drop (polling every 3 seconds), with ephemeral key pairs and hardcoded actor public keys. Commands can run Go or JavaScript (via node) or self-delete. Aikido links this to the February 2026 ReversingLabs Graphalgo npm campaign via shared Slack workspaces, contracts and the public key; it names no group. The Hacker News reports the wider Graphalgo activity overlaps with DPRK-linked (Lazarus/Contagious Interview) operations; this is secondary and treated as low confidence.

RemControl (Android banking trojan): Group-IB (23 Sep 2026) documented a MaaS Android banker operated by an affiliate tagged UNKK with a suspected link to the Medusa banker. Droppers (instal*tvtap*.apk) are distributed via fake Google Play pages and Meta-Pixel-driven malvertising impersonating the TVTap IPTV app, gated to Italian mobile users. The dropper starts a local VPN (BIND_VPN_SERVICE) to block Play Protect traffic, uses a per-install signing certificate and a custom DEX packer, then requests Accessibility Service access to run WebView overlays for PINs, banking codes and card data, stream screenshots and UI hierarchy, log keystrokes, capture pattern locks across ten OEMs and block removal/factory-reset screens. C2 resolves through Telegram dead drops (AES-128-CBC), uses WebSocket with an HTTP POST /api fallback, and an operator panel. More than 30 banking institutions in Italy, France, Spain, Poland, Portugal, Canada and GCC states are targeted.

Nightmare Eclipse (Windows Defender): The researcher also tracked as Chaotic Eclipse / Nightmare-Eclipse (reported by Security Affairs as Abdelhamid Naceri) released BigDiskBuster (github.com/MSNightmare/BigDiskBuster), reported 22 Sep 2026 as a PoC that prevents Microsoft Defender from receiving platform and signature updates (a denial-of-service condition compared by the researcher to UnDefend). The researcher states it works on all supported Windows versions but the PoC is buggy. No CVE or Microsoft fix was reported at time of writing. It follows a 2026 series of Nightmare Eclipse Windows/Defender exploits (BlueHammer, RoguePlanet, ShieldBreak, ShieldCrash and others), several of which Microsoft has since patched.

No single actor, CVE or CVSS applies to the snapshot as a whole; severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Discovery

T1082 System Information Discovery

Initial Access

T1195 Supply Chain Compromise

Credential Access

T1417 Input Capture

Collection

T1513 Screen Capture

Resource Development

T1583 Acquire Infrastructure

Remediation

Patches

  • No CVE or vendor patch identified for BigDiskBuster at time of writing; track Microsoft Security Update Guide and Defender platform releases

Immediate actions

  • Audit Terraform lock files, provider sources and go.mod/go.sum for gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree and gogets.dev/btreex; remove and rotate credentials on any hosts that ran terraform init/apply or go build with them
  • Block network IOCs for RemControl and Graphalgo at DNS/proxy and alert on egress to Slack API or Arbitrum Sepolia RPC from build/CI hosts
  • Disable the Windows Run dialog (Win+R) via policy where feasible and alert on PowerShell launched from explorer.exe with clipboard-pasted long commands
  • Review WordPress sites for injected obfuscated JavaScript and unauthorized administrator accounts; isolate affected web servers
  • Monitor Microsoft Defender platform/signature update status and alert on hosts whose definitions are stale

Workarounds

  • Block unknown-source app installs and unknown VPN services on corporate Android devices
  • Use tamper protection and centralized Defender update monitoring

Longer-term hardening

  • Pin Terraform providers to verified publishers and enforce a private registry mirror with allowlist
  • Enforce Go module proxy allowlisting and review of new dependencies; do not trust pkg.go.dev release dates
  • Educate users on ClickFix paste-and-run lures
  • Restrict sideloading and Accessibility Service grants on managed Android devices; enable Play Protect and mobile threat defense

Affected and fixed versions

  • Microsoft — Windows Defender / Microsoft Defender Antivirus
    Vulnerable versions: All supported Windows versions (per researcher claim)
  • HashiCorp — Terraform Registry providers
    Vulnerable versions: gocommunity-io/dockerd; kreuzwenker/docker
  • Go ecosystem — Go modules
    Vulnerable versions: gocommunity.io/orderedbtree; gogets.dev/btreex
  • WordPress — Compromised WordPress sites
    Vulnerable versions: Sites with injected Exvicy/ErrTraffic JavaScript
  • Google — Android
    Vulnerable versions: Devices that install RemControl droppers and grant Accessibility Service

Timeline

  • ErrTraffic ClickFix framework begins being sold on Exploit.IN (December 2025, exact day not stated)
  • ReversingLabs first documents the Graphalgo npm campaign (February 2026, exact day not stated)
  • RemControl C2 domain locked-ioc-21 registered; infrastructure active from May 2026
  • Exvicy ClickFix MaaS advertised on Exploit.IN
  • RemControl fake TVTap domains locked-ioc-20 and tvtap-liveapp.com registered
  • First RemControl samples submitted to VirusTotal; Medusa droppers switch to RemControl payloads
  • locked-ioc-16/orderedbtree first published; earliest actor contract transaction on 6 Aug 2026
  • locked-ioc-22/btreex published with forged commits backdated to November 2025; Terraform providers published in early September
  • Sekoia publishes technical analysis of Exvicy as an ErrTraffic copycat
  • Aikido reports malicious Terraform providers/Go modules; BigDiskBuster Defender update-DoS PoC reported by Security Affairs
  • Group-IB publishes RemControl analysis; The Hacker News and BleepingComputer cover Graphalgo and RemControl
  • QuoIntelligence publishes Threat Intelligence Snapshot Week 39 (coverage 17-23 September 2026)

Sources cited

Further reading

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats