Introduction
While monitoring the threads related to malware distribution on the Russian-speaking cybercrime forum Exploit.IN, Sekoia’s Threat Detection & Research (TDR) team uncovered Exvicy, a ClickFix malware distribution framework advertised by a threat actor under the handle @Exvicy. This emerging Malware-as-a-Service (MaaS) positions itself as a competitor to ErrTraffic, a prominent framework sold by the threat actor @LenAI since December 2025 and detailed in our blog post Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework.
By pivoting from technical artifacts embedded in screenshots of the Exvicy administration panel posted on Exploit.IN, TDR analysts identified the associated Exvicy server infrastructure. Consequently, we uncovered Exvicy ClickFix pages impersonating Cloudflare Turnstile verification challenges, as well as a cluster of compromised WordPress websites used to deliver the framework.
Despite @Exvicy’s public claims that this framework is a distinct product because the ClickFix social engineering lure relies on the “Win+R” shortcut instead of “Win+X”, technical analysis revealed several similarities with ErrTraffic. Examination of the Excvicy JavaScript framework demonstrated that it reuses the ErrTraffic JavaScript codebase, including the obfuscated script injected to compromised WordPress sites and the ClickFix lure responsible for Command and Control (C2) communications.
This report details how TDR pivoted from a forum advertisement to identify confirmed operator infrastructure, analyzes the Exvicy infection chain, and provides code evidence establishing that this emerging MaaS is a direct copycat of the adopted ErrTraffic framework.
An emerging ClickFix MaaS on Exploit.IN
Advertising thread and feedbacks
The Exvicy ClickFix framework was first advertised on 26 May 2026, in an Exploit.IN thread titled “[RENT] CLICKFIX panel for your leads, traffic”. The seller is a Russian-speaking threat actor operating under the handle @Exvicy on both Exploit.IN and Telegram. He initially priced the framework, which includes both the JavaScript component and the administration panel, at $1,200 per month. In mid-August 2026, the operator increased the subscription fee to $2,000 per month, asserting that “detections are becoming daily”. Because the framework likely requires more frequent updates to evade detection, the operator raised the price to reflect the ongoing effort needed to maintain its operational efficacy.
Below is @Exvicy’s initial post introducing the MaaS framework (translated from Russian):
🚀 Good day!
Came out of private.
I present to you my solution for you. My panel will be convenient for implementing your traffic
⚙️ Functionality
Panel appearance
(Screenshot available in Annex.)
The price of this product per month is $1200/month
jabber/tox in PM upon request.
This post suggests that the operator previously offered the ClickFix framework exclusively to a small private group of threat actors. Over the following weeks, four Exploit.IN users vouched for the service, describing a reliable “knock” (the initial request sent to serve ClickFix pages), frequent panel updates, regular infrastructure rotation (to mitigate detections and domain blocking), and responsive support. As of early June 2026, two alleged customers claimed to have used the framework for over a month and three months, respectively, aligning with the prior private offering.
On 26 June 2026, a user challenged the framework’s pricing by comparing Exvicy to @LenAI’s ErrTraffic MaaS. @Exvicy responded that the framework he was selling relied on the “Win+R” shortcut rather than “Win+X” (to open the Windows Run dialog box and execute the ClickFix command on the host), adding that he set “the price for the product to whatever I think is appropriate”. The operator also posted a video demonstrating command execution speed. This interaction indicates that the specific execution shortcut used to infect victims served as the primary advertised differentiator between the two ClickFix frameworks.
From a forum screenshot to the adversary’s infrastructure
The initial post, shown above, includes a screenshot of the administration panel, specifically the domain management tab. Although not explicitly labeled, a tab designated for managing Cloudflare C2 domains includes the Exvicy C2 domain registered by the attacker. The screenshot on Exploit.IN shows a redacted domain hidden behind a white overlay: the domain uses the .com TLD and contains approximately 15 to 16 characters in its name. Furthermore, this domain uses the Cloudflare DNS nameserver pair randy.ns.cloudflare[.]com / stevie.ns.cloudflare[.]com.
By searching for .com domains registered since mid-May 2026 that share this specific nameserver pair, TDR analysts identified five matching domains:
These domains were registered through FewMoreTaps and PublicDomainRegistry, and they all use TLS certificates issued by Google Trust Services. Given the thematic and lexical similarities in their naming conventions (e.g. verification, device, captcha), we assess that these domains were likely registered by the same threat actor to host deceptive Cloudflare CAPTCHA verification pages.
Scanning domains revealed a login page at hxxps://us-addnewdevice[.]com/panel (urlscan.io's scan of a suspected Exvicy login page at us-addnewdevice[.]com/panel). As shown in the figure below, the design of this login page is identical to the Exvicy “Download statistics” interface published in the Exploit.IN thread. Furthermore, the login page defaults to Russian and features a RU/EN language toggle, matching the language option observed in @Exvicy’s forum screenshots.
Additionally to the matching interface design, we found an obfuscated PowerShell script hosted at hxxps://us-addnewdevice[.]com (urlscan.io's scan of the suspected Exvicy domain returning a malicious PowerShell dropper). This script functions as a downloader, retrieving an MSI installer from a Cloudflare R2 bucket and sending installation status updates to a C2 server, 89.34.90[.]159 in the AS207043 (DEDIK-IO). The MSI installs the legitimate PuTTY application, an SSH client that provides remote shell access to the host. In the Exploit.IN thread, the operator posted a screenshot of a “Files” management table listing payload files intended for distribution via the Exvicy framework, which included a file named putty.exe. Based on this evidence, we assess with high confidence that the PowerShell discovered on this infrastructure is a component of the Exvicy framework.
Consequently, we assess with high confidence that we have identified an active Exvicy server infrastructure operated directly by the threat actor selling the framework.
Exvicy ClickFix pages
From Exvicy panels to ClickFix pages
By pivoting on the discovered Exvicy panel, we found additional active administration panels on the following URLs on 9 July 2026:
Several of these servers hosted a ClickFix page impersonating a Cloudflare Turnstile verification challenge and, as described by @Exvicy, the lure relies on the Windows shortcut “Win+R” to open the Run dialog box and deceives users into running the malicious ClickFix command, as shown below.
This ClickFix page fully aligns with the malware distributed framework advertised by @Exvicy on Exploit.IN. Pivoting on these pages, we were able to find WordPress sites injected with this framework in the wild.
Analysis of ClickFix lure pages
Injected JavaScript
The Exvicy framework relies on injecting a brief initial JavaScript snippet into a legitimate WordPress site, previously compromised by the attacker. This script contains a payload obfuscated via Base64 encoding and XOR encryption, as well as randomized variable names. Upon execution, its primary function is to deobfuscate and execute the embedded payload.
As of mid-August 2026, example of both the initial Exvicy script and the deobfuscated payload are available on Gist (Initial Exvicy obfuscated script and Exvicy deobfuscated payload from the initial script). This Exvicy JavaScript snippet was injected into a compromised WordPress book promotion site scanned by urlscan.io (urlscan.io's scan of a book promotion WordPress compromised by Exvicy, by mid-August 2026).
The deobfuscated payload is a JavaScript responsible for:
- Setting a deduplication flag to ensure the framework executes only once on the host system.
- Creating a full-screen iframe titled “Security Check”, which subsequently remotely loads and displays an HTML page.
- Initiating communication with the Exvicy C2 server to register both the potential victim and the original website, and fetch the next stage.
The Exvicy C2 servers are hardcoded directly within the obfuscated JavaScript. In this instance, two distinctive hosts were identified: hxxps://cloudflare-check[.]net and hxxp://94.26.90[.]126. The script retrieves a ClickFix HTML page using the following URL structure: /embed/<ID>?embed=1&host=<WP_SITE>.
ClickFix HTML
The ClickFix HTML impersonates a Cloudflare Turnstile challenge, designed to deceive victims into executing a malicious command via the Windows Run dialog under the pretext of completing a CAPTCHA verification.
This HTML contains three Base64-encoded and XOR-encrypted JavaScript, which perform the following functions:
- Preventing double execution via a global flag.
- Identifying and storing the domain of the impersonated page.
- Executing ClickFix actions: initiating C2 communications with Exvicy’s infrastructure, concealing the original page content, constructing a fake full-screen Cloudflare Turnstile page, displaying ClickFix instructions, notifying the C2 server upon interaction with the CAPTCHA challenge, and polling the C2 for status updates.
Additionally, the page renders the domain of the compromised WordPress if it was previously collected and set in the _cfDomain JavaScript variable, otherwise it defaults to displaying “Microsoft.com” or “cloudflare.com” depending on the payload version.
ClickFix instructions are translated into 13 languages (English, German, French, Spanish, Italian, Portuguese, Russian, Ukrainian, Chinese, Japanese, Korean, Turkish, and Arabic), selecting the text based on the browser’s configuration. To purportedly verify that the user is human, the interface instructs the user to press “Win + R”, then “Ctrl + V”, followed by “Enter”. These keystrokes paste and execute a malicious PowerShell command in the Windows Run prompt. The Base64-encoded command is embedded at the top of the HTML page and copied to the user’s clipboard via the copyText JavaScript function.
As of mid-August 2026, Exvicy uses a straightforward PowerShell command downloading and executing a remote PowerShell script, e.g.:
Exvicy C2 communications
The initial request sent to the C2 server is an HTTP GET request generated by the primary obfuscated JavaScript to fetch the ClickFix HTML page from /embed/<ID>?embed=1&host=<WP_SITE>.
Once the HTML executes within the compromised WordPress site, Exvicy framework sends an HTTP GET containing an identifier token in the k parameter /api.php?k=[a-f0-9]{48}&d=<base64-encoded-data>, likely to convey host telemetry to the C2 server.
Concurrently, one of Base64-encoded JavaScript snippets initiates communication with the /api.php endpoint using HTTP POST requests to update the ClickFix execution status. These C2 communications consists of three actions:
Additionally, the HTML page transmits two HTTP GET requests to /panel/html-event/{pid}/hit?type={typ}&t={timestamp} using different type values: visit and click, respectively sent when loading the spoofed Cloudflare Turnstile page, and sent upon clicking the fake checkbox. These telemetry requests are likely designed to track metrics and user conversion rates. While slightly redundant with these requests sent by the JavaScript snippet, they transmit different contextual parameters simultaneously.
Similarities with ErrTraffic
Injected JavaScript snippets
As previously documented by our team, ErrTraffic is a JavaScript framework injected into compromised WordPress sites to deliver ClickFix lures. Sold as a MaaS by @LenaAI on Exploit.IN since December 2025, ErrTraffic gained significant popularity among threat actors in early 2026. It became a leading competition among ClickFix distribution clusters, alongside ClearFake, KongTuke, SmartApeSG, and IClickFix.
The Exvicy framework highly likely borrowed codes from ErrTraffic, specifically for the initial JavaScript injected into the compromised WordPress environments, using the same obfuscation techniques, execution routine, and structural patterns. As of mid-August 2026, examples of both the initial ErrTraffic script and the deobfuscated payload are available on Gist (Initial ErrTraffic obfuscated script and ErrTraffic deobfuscated payload). The payload primarily retrieves the ErrTraffic C2 domain (analysis-id-lfg[.]info) from the Polygon blockchain using the contract address 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2. Notably, this smart contract address was created by the wallet address 0xCaf2C54E400437da717cF215181B170F65187aBf, which appears to serve as the central operational hub for cybercriminal activities attributed to the threat actor LenAI.
This ErrTraffic JavaScript snippet was injected into a compromised Brazilian WordPress site scanned by urlscan.io (urlscan.io's scan of a Brazilian website compromised by ErrTraffic, by mid-August 2026). A side-by-side comparison of the Exvicy and ErrTraffic injected scripts is shown below:
Aside from the Base64-encoded payloads and randomly generated JavaScript variable names, both scripts are nearly identical. Consequently, we assess with medium confidence that the operators of Exvicy and ErrTraffic rely on the same tool to generate these injected scripts.
Both scripts decode a Base64 payload containing JavaScript that handles communication with their respective C2 infrastructure. However, their C2 communication differs: the Exvicy script uses two hardcoded C2 servers, whereas ErrTraffic employs EtherHiding as Dead Drop Resolver (DDR) to conceal its C2 infrastructure on the blockchain.
ClickFix pages
The Exvicy HTML code retrieved from /embed/<ID>?embed=1&host=<WP_SITE>, renders the ClickFix lure, contains a JavaScript almost identical to that used by an ErrTraffic cluster impersonating the ChatGPT landing page with a reCAPTCHA-themed lure, as documented in our previous analysis.
An example of the ErrTraffic JavaScript retrieved from chatgpt-web[.]vip is available on Gist (ErrTraffic JavaScript implementing ClickFix actions using a reCAPTCHA lure), as scanned via urlquery.net in June 2026. This ErrTraffic cluster used the C2 domain verification-js-cdn[.]boats alongside the Polygon smart contract address 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2. An example of the nearly identical Exvicy script observed in mid-August 2026 is also available on Gist (Exvicy JavaScript implementing ClickFix actions using a Cloudflare Turnstile lure).
Both scripts implement the following features using identical code snippets:
Given these shared code routines, and considering that ErrTraffic is the older, more sophisticated framework featuring Etherhiding, diverse lures, and frequent C2 updates, we assess with high confidence that the developer of Exvicy reused code from ErrTraffic framework.
The Exvicy developer could have gotten ErrTraffic source code, both for client and server sides, either by being a MaaS customer, or by accessing a framework leak. Thus, @Exvicy would have built a competitor malware distribution framework based on the @LenAi code. This alleged theft of the source code to launch a competitor service would not be an isolated event in the cybercrime ecosystem.
Another hypothesis is that @Exvicy retrieved the client-side code directly from browsing compromised WordPress websites, much like CTI analysts do, and entirely reimplemented the backend infrastructure. However, this hypothesis is less plausible: given the effort to rebuild the server side, a threat actor could just as easily vibe-code a custom client-side from scratch, rather than re-engineering an existing one.
Conclusion
Sekoia TDR analysts discovered Exvicy, an emerging ClickFix malware distribution framework sold as Malware-as-a-Service and advertised on Exploit.IN since May 2026. By pivoting on a partially redacted domain name and a Cloudflare nameserver pair visible in a screenshot of the administration panel, we uncovered an Exvicy cluster comprising domains and IP addresses hosting administration panels, PowerShell scripts, and ClickFix lures impersonating Cloudflare Turnstile verification challenges.
Exvicy is a new competitor to ErrTraffic, primarily distinguishing itself by using the “Win+R” keyboard shortcut instead of the “Win+X” to launch the Windows Run prompt in its ClickFix lure. We assess with high confidence that Exvicy is a copycat of ErrTraffic built on a reused client-side codebase. The Exvicy operator either acquired the ErrTraffic’s source code, or extracted its client-side JavaScript to construct the framework.
TDR analysts have observed telemetry for Exvicy C2 infrastructure across multiple Sekoia customers environments, confirming that the framework has been actively adopted by threat actors and deployed across numerous compromised WordPress sites.
To protect our customers from Exvicy, ErrTraffic, and other ClickFix-based frameworks, Sekoia.io analysts will maintain proactive monitoring of these emerging threats and continue tracking their C2 infrastructure.
IoCs
C2 infrastructure
By 25 August 2026:
Infrastructure hosting administration panels
By 25 August 2026:
The Exvicy panel is accessible at /panel on port 80. Pages at / return the Exvicy ClickFix page, which impersonates Cloudflare Turnstile.
Annex
Screenshots attached to Exvicy advertisement on Exploit.IN
This is the Exvicy tab for managing files to deliver through the framework.
Below is the Exvicy tab for allegedly managing C2 domains hosted behind Cloudflare.
Here is the Exvicy tab for managing Telegram bot to notify for new visitors on sites compromised with Exvicy
This is the Exvicy tab for downloading statistics:
This is the Exvicy tab for managing Exvicy ClickFix pages:
Finally, this is the Exvicy tab for allegedly managing traffic filtering based on user geolocation:
