Loading story…
Sekoia identified Exvicy, a Russian-speaking malware-as-a-service ClickFix framework advertised on the Exploit.IN forum and deployed through compromised WordPress sites. The service injects obfuscated JavaScript to display counterfeit Cloudflare Turnstile checks, coercing victims to paste clipboard-delivered PowerShell into the Windows Run dialog. The resulting chain retrieves additional PowerShell payloads and an MSI installer from Cloudflare R2, ultimately installing the legitimate PuTTY SSH client for remote access.
Researchers observed Exvicy command-and-control communications in customer environments and identified about 80 hosts exposing its administration panel by late August. Sekoia assessed with high confidence that Exvicy substantially copies the rival ErrTraffic framework, retaining its obfuscation, deduplication, multilingual capabilities, and much of its C2 logic; unlike ErrTraffic, however, Exvicy uses hardcoded C2 servers rather than Polygon blockchain-based EtherHiding. Organizations should investigate exposure to compromised WordPress sites, fake verification prompts, suspicious PowerShell execution, and the identified Exvicy infrastructure.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Sekoia published research detailing Exvicy's compromised-WordPress ClickFix delivery chain and reporting customer-environment communications with its C2 servers. The researchers assessed with high confidence that Exvicy substantially reused ErrTraffic code, while using hardcoded C2 servers rather than ErrTraffic's Polygon EtherHiding mechanism.
By late August, Sekoia had identified approximately 80 hosts serving Exvicy administration panels, indicating expanded supporting infrastructure.
The Exvicy operator increased the framework's monthly rental price from $1,200 to $2,000, citing the need for frequent updates as detections became more common.
Sekoia identified 13 additional Exvicy panels after pivoting from infrastructure details visible in the operator's advertisement screenshot.
A Russian-speaking actor using the Exvicy handle advertised a ClickFix panel rental service on Exploit.IN for $1,200 per month. The service was designed to distribute malware through compromised WordPress websites.
The ErrTraffic ClickFix framework began being sold on the Exploit.IN cybercrime forum.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026
Threat actors are scaling **ClickFix**-style “self-infection” attacks that abuse compromised legitimate websites to trick users into manually executing malicious PowerShell via the Windows Run dialog or a terminal. Reporting describes the **KongTuke** campaign evolving its tradecraft by retrieving next-stage instructions from **DNS TXT records** rather than over HTTP, reducing visibility for controls focused on web traffic and blending activity into normal DNS resolution. The objective is follow-on malware deployment and persistence, including installation of remote-access tooling such as the **Interlock RAT**. Separately, researchers described a large **watering-hole** operation dubbed **IClickFix** that poisoned **3,800+ WordPress sites** with a fake *Cloudflare Turnstile CAPTCHA* prompt that instructs visitors to copy/paste and run a “fix” command. Once executed, the staged PowerShell pulls commodity payloads including **NetSupport RAT**, **Emmenhtal Loader**, and **XFiles Stealer**, and uses tracking/targeting logic (e.g., an `ic-tracker-js` HTML tag) to manage victim flow. In contrast, a different WordPress compromise technique called **“directory shadowing”** was reported as an SEO-spam operation that creates physical folders matching WordPress permalinks and serves gambling content selectively to crawlers (via User-Agent checks), which is not part of the ClickFix execution chain.
Sep 3, 2026
Researchers detailed **ErrTraffic**, a growing malware-as-a-service framework that injects JavaScript into compromised WordPress sites to present **ClickFix** lures and deliver malware. The operation uses **EtherHiding** on the Polygon blockchain to conceal and rotate command-and-control infrastructure, and investigators identified two clusters—**Analytics** and **Beer**—with different smart-contract usage, C2 methods, JavaScript implementations, and payload delivery patterns. The **Beer** cluster is assessed as the active rental service used by multiple affiliates, while **Analytics** appears tied to a single operator using acquired source code. Campaigns linked to ErrTraffic used stolen WordPress administrator credentials, PHP backdoors, malicious MU-plugins, and fake AI-themed sites impersonating **Google Antigravity** and **ChatGPT** to distribute malware including **Vidar**, **Stealc**, **DanaBot**, **HijackLoader**, **Remus**, **Salat**, and **SmokeLoader**. Separate reporting also exposed a live malware distribution backend after a researcher found an unsecured PHP installer at `/install/install.php`, allowing administrative access to the panel that managed hosted payloads, dynamic download pages, and multi-stage redirection chains; although the operators patched that weakness, the infrastructure reportedly remains active. Defenders were provided with domains, delivery URLs, and file hashes to support detection and response.
Jul 12, 2026