A new ClickFix malware-as-a-service (MaaS) framework called Exvicy has been built on code lifted from a rival service, ErrTraffic.
According to a technical write-up published by Sekoia’s Threat Detection & Research team on September 21, telemetry from multiple customer environments showed hosts communicating with Exvicy command-and-control (C2) servers. That confirms threat actors are using it to deliver malware through compromised WordPress sites.
The seller, a Russian-speaking actor using the handle Exvicy, has advertised the MaaS on the Exploit.IN forum since May 26. It launched at $1,200 a month and rose to $2,000 in mid-August, with the operator claiming “detections are becoming daily.”
When a forum user questioned the price against ErrTraffic, sold on the same forum since December 2025, the seller said his product relied on the Win+R shortcut rather than ErrTraffic’s Win+X.
From a Forum Screenshot to Live Panels
Sekoia found the operator’s infrastructure through a screenshot in the advert itself. A redacted domain in the admin panel still showed its length, top-level domain and Cloudflare nameserver pair, which narrowed the search to five recently registered domains.
One hosted a login page identical to the panel in the screenshot, and a PowerShell downloader there fetched a file matching one in the operator’s own payload list. Pivoting from that panel turned up 13 more on July 9, and by late August Sekoia’s list of hosts serving the panel ran to about 80.
The framework injects obfuscated JavaScript into compromised WordPress sites, which loads a fake Cloudflare Turnstile check. Victims are told to press Win+R, paste and press Enter, running a PowerShell command already copied to their clipboard, with instructions in 13 languages.
The page reports each step back to the operator, including when the victim clicks the fake checkbox, then polls for three minutes to confirm the command ran.
Read more: ClickFix Now Cybercriminals’ Favorite Malware Delivery Technique
Near-Identical Code, One Real Difference
Sekoia assessed with high confidence that Exvicy reuses ErrTraffic’s code in both the injected script and the lure page. Beyond encoded payloads and randomized variable names the injected scripts are nearly identical, and the lure pages share the same clipboard, fingerprinting, anti-analysis and polling functions.
It assessed with medium confidence that both operators use the same tool to generate the injected scripts. The clearest technical difference is not the shortcut: ErrTraffic hides its C2 address on the Polygon blockchain, a technique known as EtherHiding, while Exvicy hardcodes two servers.
Sekoia said Exvicy’s developer most likely obtained ErrTraffic’s source code, either as a paying customer or through a leak. Scraping the client-side code from infected sites and rebuilding the backend was less plausible since that would take as much effort as writing new code itself.
