Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites

A new Malware-as-a-Service platform, Exvicy, is actively abusing compromised WordPress websites to deliver ClickFix lures disguised as Cloudflare Turnstile verification pages.

Researchers at Sekoia assess with high confidence that the service is a copycat of the established ErrTraffic framework, reusing its JavaScript injection logic, fake-verification code, and command-and-control communication routines

The actor initially rented the framework for $1,200 per month, later increasing the price to $2,000 in August while claiming that detection pressure required continual updates.

The offering includes an administration panel and JavaScript tooling designed to turn compromised websites into malware-delivery portals.

Sekoia’s Threat Detection and Research team traced the operation from a screenshot posted in the sales thread.

The image showed part of an Exvicy administration panel and a partly concealed Cloudflare-managed domain.

By pivoting on the visible DNS configuration and registration timing, researchers identified domains linked to the operator, including us-addnewdevice[.]com, cloudflarecapcha[.]com, perfectverified[.]com, newsecuredevice[.]com, and unitedstateverif[.]com.

The infrastructure hosted Exvicy panel pages, PowerShell payloads and fake Cloudflare verification content.

Researchers also found a downloader hosted through the identified infrastructure that retrieved an MSI payload from a Cloudflare R2 bucket.

In one observed case, the installer deployed the legitimate PuTTY SSH client, demonstrating that the framework can be used to distribute arbitrary payloads rather than being tied to a single malware family.

The infection chain begins when attackers inject an obfuscated JavaScript snippet into a compromised WordPress site.

Sekoia observed that, Exvicy was first advertised on the Russian-speaking Exploit.IN cybercrime forum on May 26, 2026, by an operator using the handle @Exvicy.

Exvicy ClickFix Malware

The injected code uses Base64 encoding, XOR encryption and randomized variable names to hinder inspection.

Once decoded in a visitor’s browser, it creates a full-screen iframe labeled “Security Check,” contacts Exvicy infrastructure and loads the next-stage ClickFix page.

The resulting lure impersonates a Cloudflare Turnstile CAPTCHA. Rather than exploiting a browser vulnerability, it manipulates victims into infecting themselves.

The page tells users to press “Win+R,” paste clipboard content with “Ctrl+V,” and press Enter.

Those keystrokes launch the Windows Run dialog and execute an attacker-provided PowerShell command. Exvicy supports instructions in 13 languages, broadening the reach of the campaign across regional targets.

The payload is copied to the clipboard automatically and typically retrieves another remote PowerShell script for execution.

Sekoia identified C2 communications used to register potential victims, capture browser and operating-system telemetry, track fake CAPTCHA clicks, and poll for confirmation that a victim executed the malicious command.

The platform also records visit and interaction events, giving affiliates visibility into conversion performance.

Exvicy’s claimed distinction from ErrTraffic is its use of the Win+R shortcut rather than Win+X.

However, Sekoia found the two frameworks share far more consequential code: identical FNV-1a-based deduplication logic, UUID generation, clipboard-manipulation functions, translation support, anti-analysis checks, C2 request routines and status-polling workflows.

The major difference is in C2 handling. ErrTraffic uses EtherHiding, storing C2 information in Polygon blockchain smart contracts, while Exvicy hardcodes its C2 servers in the injected script.

ErrTraffic has been marketed since December 2025 and was already known for injecting malicious JavaScript into WordPress sites to serve ClickFix lures.

Sekoia’s telemetry identified hosts in multiple customer environments communicating with Exvicy C2 servers, confirming that threat actors are already operationalizing the service.

Defenders should monitor WordPress estates for unexpected injected JavaScript, outbound browser requests to suspicious verification domains, clipboard-based PowerShell execution, and anomalous requests to /embed/, /api.php, and /panel/html-event/ paths.

Organizations should also train users that legitimate CAPTCHA checks never require opening Run, pasting a command, or executing PowerShell.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC