# QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)

> QuoIntelligence's Week 39 2026 snapshot (17-23 September 2026) highlights four concurrent threats: the Exvicy ClickFix MaaS framework copying ErrTraffic and spreading lures via compromised WordPress sites; the Graphalgo campaign delivering a Go RAT through malicious Terraform providers and Go modules; the RemControl Android banking trojan targeting retail banking customers in Europe, the Middle East and Canada; and Nightmare Eclipse's BigDiskBuster exploit that stops Microsoft Defender from updating.

- **Published:** 2026-11-11T17:44:33Z
- **Last reviewed:** 2026-11-11T17:44:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5785
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5785.png
- **ID:** TL-2026-5785
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

This record consolidates the four headline items in QuoIntelligence's Threat Intelligence Snapshot for Week 39, 2026 (published 2026-09-24). The snapshot itself is headline-level only (full write-ups are gated); technical detail below is taken from the primary vendor research for each item and is attributed accordingly.

Exvicy / ErrTraffic (ClickFix): Sekoia (21 Sep 2026) assessed with high confidence that Exvicy, a malware-as-a-service ClickFix framework advertised on Exploit.IN since 26 May 2026 (price rising from $1,200 to $2,000 per month), reuses ErrTraffic's code in both the injected script and the lure page. Obfuscated JavaScript injected into compromised WordPress sites builds a full-screen 'Security Check' iframe presenting a fake Cloudflare Turnstile check in 13 languages. Victims are instructed to press Win+R, paste a clipboard-loaded PowerShell command and press Enter; the lure page reports each step to the operator and polls for three minutes to confirm execution. Unlike ErrTraffic, which hides C2 addresses on the Polygon blockchain (EtherHiding), Exvicy hardcodes two servers. About 80 hosts served the operator panel by late August 2026.

Graphalgo (Go RAT supply chain): Aikido (22 Sep 2026, updated 24 Sep) reported the first observed malware distribution through Terraform providers. Two Terraform Registry providers (gocommunity-io/dockerd, and kreuzwenker/docker typosquatting kreuzwerker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) carry a Go port of the Graphalgo implant. The provider payload stays inert unless the SHA-256 of the runtime containerName and networkID values matches a hardcoded hash, which doubles as an AES key to decrypt an embedded ZIP that is run via a detached 'go run .'. btreex hid the payload in an encrypted ZIP disguised as btreex.sql and used forged commits to backdate history to November 2025 so the Go proxy showed a false release date. The RAT checks in with platform, hostname, username, home directory and Node.js availability, and uses two C2 channels: Slack (polling every 10 seconds) and an Arbitrum Sepolia smart contract dead drop (polling every 3 seconds), with ephemeral key pairs and hardcoded actor public keys. Commands can run Go or JavaScript (via node) or self-delete. Aikido links this to the February 2026 ReversingLabs Graphalgo npm campaign via shared Slack workspaces, contracts and the public key; it names no group. The Hacker News reports the wider Graphalgo activity overlaps with DPRK-linked (Lazarus/Contagious Interview) operations; this is secondary and treated as low confidence.

RemControl (Android banking trojan): Group-IB (23 Sep 2026) documented a MaaS Android banker operated by an affiliate tagged UNKK with a suspected link to the Medusa banker. Droppers (instal*tvtap*.apk) are distributed via fake Google Play pages and Meta-Pixel-driven malvertising impersonating the TVTap IPTV app, gated to Italian mobile users. The dropper starts a local VPN (BIND_VPN_SERVICE) to block Play Protect traffic, uses a per-install signing certificate and a custom DEX packer, then requests Accessibility Service access to run WebView overlays for PINs, banking codes and card data, stream screenshots and UI hierarchy, log keystrokes, capture pattern locks across ten OEMs and block removal/factory-reset screens. C2 resolves through Telegram dead drops (AES-128-CBC), uses WebSocket with an HTTP POST /api fallback, and an operator panel. More than 30 banking institutions in Italy, France, Spain, Poland, Portugal, Canada and GCC states are targeted.

Nightmare Eclipse (Windows Defender): The researcher also tracked as Chaotic Eclipse / Nightmare-Eclipse (reported by Security Affairs as Abdelhamid Naceri) released BigDiskBuster (github.com/MSNightmare/BigDiskBuster), reported 22 Sep 2026 as a PoC that prevents Microsoft Defender from receiving platform and signature updates (a denial-of-service condition compared by the researcher to UnDefend). The researcher states it works on all supported Windows versions but the PoC is buggy. No CVE or Microsoft fix was reported at time of writing. It follows a 2026 series of Nightmare Eclipse Windows/Defender exploits (BlueHammer, RoguePlanet, ShieldBreak, ShieldCrash and others), several of which Microsoft has since patched.

No single actor, CVE or CVSS applies to the snapshot as a whole; severity is analyst-assigned.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1583 Acquire Infrastructure
- T1417 Input Capture
- T1513 Screen Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Win+R PowerShell Paste-and-Run (Exvicy/ErrTraffic) — Exploitation** (`TL-2026-5785-SPL-001`)

Detects PowerShell spawned by explorer.exe with download, encoded or hidden-window arguments and a long command line, the behavioural footprint of Exvicy/ErrTraffic ClickFix lures (fake Cloudflare Turnstile Security Check on compromised WordPress sites instructing the victim to press Win+R, paste and Enter). Behaviour-first: it does not depend on the operator's hardcoded servers, so it survives infrastructure rotation. Tracked under TL-2026-5785 (MITRE T1204, T1059, T1027, T1189).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204, T1059, T1027, T1189
- **Data sources:** sysmon, windows_security, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*iex *" OR CommandLine="*Invoke-Expression*" OR CommandLine="*iwr *" OR CommandLine="*irm *" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*DownloadString*" OR CommandLine="*FromBase64String*" OR CommandLine="* -enc *" OR CommandLine="*-EncodedCommand*" OR CommandLine="*-w hidden*" OR CommandLine="*-WindowStyle Hidden*")
```Exvicy/ErrTraffic ClickFix: victim pastes a clipboard-loaded PowerShell one-liner into Win+R, so the shell is parented by explorer.exe```
| eval cmd_len=len(CommandLine)
| where cmd_len>80
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
// Exvicy / ErrTraffic ClickFix: Win+R paste-and-run is parented by explorer.exe
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where strlen(ProcessCommandLine) > 80
| where ProcessCommandLine has_any ("iex ", "Invoke-Expression", "iwr ", "irm ", "Invoke-WebRequest", "Invoke-RestMethod", "DownloadString", "FromBase64String", " -enc ", "-EncodedCommand", "-w hidden", "-WindowStyle Hidden")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Win+R PowerShell Paste-and-Run (Exvicy / ErrTraffic)
id: 3b7e1c52-8d4a-4f6e-9a21-5c0d7e8f1a01
status: experimental
description: Detects PowerShell launched directly by explorer.exe with download, encoded or hidden-window arguments, the process pattern left when a victim pastes a clipboard-loaded command into the Win+R Run dialog after an Exvicy or ErrTraffic fake Cloudflare Turnstile Security Check lure.
references:
    - https://quointelligence.eu/2026/09/threat-intelligence-snapshot-week-39-2026/
    - https://www.aikido.dev/blog/graphalgo-terraform-go-modules
    - https://www.group-ib.com/blog/remcontrol-android-banking-trojan/
    - https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.execution
    - attack.t1204
    - attack.t1059
    - attack.defense-evasion
    - attack.t1027
    - attack.initial-access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd:
        CommandLine|contains:
            - 'iex '
            - 'Invoke-Expression'
            - 'iwr '
            - 'irm '
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadString'
            - 'FromBase64String'
            - ' -enc '
            - '-EncodedCommand'
            - '-w hidden'
            - '-WindowStyle Hidden'
    condition: all of selection_*
falsepositives:
    - Administrators or helpdesk staff manually pasting a PowerShell download one-liner into the Run dialog
    - Software deployment or onboarding snippets launched interactively from the desktop
level: high

```

**Known false positives:**

- Administrators or helpdesk staff pasting a PowerShell download one-liner into the Run dialog
- Interactive software-install or onboarding snippets launched from the desktop shell

**Tuning notes:** Requires Sysmon EventCode 1 in index=sysmon (adjust index/sourcetype to your environment). Raise cmd_len above 80 or exclude known admin accounts and vetted internal script hosts via User. Pair with a RunMRU registry-write detection (Explorer RunMRU values containing powershell) to catch the Run dialog directly. The Exvicy hardcoded C2 servers are not published in the research, so add them as IOCs when available.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Graphalgo Malicious Terraform Provider / Go Module Usage — Exploitation (Supply Chain) (locked: unlock with TL Creds)
- BigDiskBuster Defender Update DoS (Nightmare Eclipse) — Post-Exploitation (locked: unlock with TL Creds)
- RemControl Android Banker C2, Operator Panel and Telegram Dead Drop — C2 (locked: unlock with TL Creds)
- RemControl Android Banker Distribution via Fake TVTap Sites — Exploitation (locked: unlock with TL Creds)
- Graphalgo Disguised ZIP Payload Files and Package Cache Writes — Post-Exploitation (locked: unlock with TL Creds)
- Graphalgo Actor Domains DNS Resolution — C2 (locked: unlock with TL Creds)
- Graphalgo Go RAT Execution via Terraform Provider and go run — Post-Exploitation (locked: unlock with TL Creds)
- Graphalgo Go RAT C2 via Slack Workspaces and Arbitrum Sepolia Dead Drop — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `193.247.144[.]38`
- Domain: `gocommunity[.]io`
- URL: `hxxps://tvtap-liveapp[.]com/dl.php`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Threat Intelligence Snapshot: Week 39, 2026 (QuoIntelligence)](https://quointelligence.eu/2026/09/threat-intelligence-snapshot-week-39-2026/)
- [Graphalgo: Terraform providers and Go modules (Aikido)](https://www.aikido.dev/blog/graphalgo-terraform-go-modules)
- [Attackers Use Malicious Terraform Providers to Deliver Go Malware (The Hacker News)](https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html)
- [Graphalgo campaign moves upstream into infrastructure as code (ReversingLabs)](https://www.reversinglabs.com/blog/graphalgo-campaign-moves-upstream-into-infrastructure-as-code)
- [RemControl Android banking trojan (Group-IB)](https://www.group-ib.com/blog/remcontrol-android-banking-trojan/)
- [New RemControl Android banking malware targets users in Europe and Canada (BleepingComputer)](https://bleepingcomputer.com/news/security/new-remcontrol-android-banking-malware-targets-users-in-europe-and-canada)
- [RemControl Banking Trojan Gives Attackers Remote Control of Android Devices (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/banking-trojan-remote-control/)
- [Exvicy: A copycat of the ErrTraffic malware distribution framework (Sekoia)](https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework)
- [New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/exvicy-clickfix-framework/)
- [ErrTraffic Malware Campaign: ClickFix and EtherHiding (WatchGuard)](https://www.watchguard.com/br/wgrd-security-hub/secplicity-blog/errtraffic-malware-campaign-clickfix-and-etherhiding)
- [Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day (Security Affairs)](https://securityaffairs.com/199538/hacking/chaotic-eclipse-released-bigdiskbuster-a-poc-for-windows-defender-update-dos-zero-day.html)
- [BigDiskBuster PoC repository](https://github.com/MSNightmare/BigDiskBuster)
- [Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit (Dark Reading)](https://www.darkreading.com/vulnerabilities-threats/nightmare-eclipse-strikes-again-shieldcrash-windows-exploit)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5785