cyber.hendryadrian.com
Threat Research · sekoia.com

Sekoia Finds Exvicy ClickFix Framework Reuses ErrTraffic Code

· Original article ↗

Summary

Sekoia researchers traced Exvicy, a ClickFix malware-as-a-service framework, from a cybercrime forum to active infrastructure. They detail its infection chain and assess with high confidence that it reuses ErrTraffic code.

Key points

  • Exvicy is a ClickFix malware distribution framework advertised as a service on Exploit.IN since May 2026.
  • Researchers linked the framework to domains and servers hosting admin panels, ClickFix pages and PowerShell scripts.
  • Compromised WordPress sites inject JavaScript that loads a fake Cloudflare Turnstile page and prompts users to run a malicious command through Windows Run.
  • The command downloads and executes a remote PowerShell script; observed infrastructure also delivered an MSI installing PuTTY.
  • Sekoia found near-identical client-side code and C2 workflows in Exvicy and ErrTraffic, and assesses that Exvicy reused ErrTraffic code.
  • Sekoia telemetry showed systems in multiple customer environments communicating with Exvicy C2 infrastructure, indicating active use.

Article Details

Attack Vectors
  • JavaScript injected into previously compromised websites decodes an embedded payload and loads a full-screen iframe containing a fake CAPTCHA challenge.
  • The fake verification challenge copies a malicious command to the clipboard and instructs victims to press Win+R, Ctrl+V, and Enter, causing PowerShell execution.
  • The PowerShell command downloads and executes a remote script. One analyzed downloader retrieved an MSI installer and reported installation status to a C2 server.
  • The lure sends victim fingerprint data and interaction events to C2 infrastructure and polls for confirmation that the command was executed.
Defensive Notes
  • The researchers identified administration panels at /panel on port 80; root pages on the listed infrastructure returned fake verification challenges.
  • The researchers reported customer-environment telemetry communicating with the framework's C2 infrastructure.
  • The publisher stated that its analysts would continue monitoring the frameworks and tracking their C2 infrastructure.

Indicators of compromise

TypeIndicatorContext
DOMAINairduct1[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINamalqasehselangor[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINanalysis-id-lfg[.]infoErrTraffic C2 domain retrieved from a Polygon smart contract by its injected payload.
DOMAINannamaclean[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINarushigupta[.]lifeListed infrastructure hosting Exvicy administration panels.
DOMAINascendpopdownloadtoday[.]monsterListed infrastructure hosting Exvicy administration panels.
DOMAINasiana-online[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINbetesebplus[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINbluemountainloan[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINboardgamepix[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINboundpopclickgetfile[.]monsterListed Exvicy C2 and administration-panel infrastructure.
DOMAINbreadcabin[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINcanflymarketing[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINchatgpt-web[.]vipHosted ErrTraffic JavaScript implementing a ChatGPT impersonation and reCAPTCHA-themed ClickFix lure.
DOMAINclickzona[.]netListed Exvicy C2 infrastructure.
DOMAINcloudflare-check[.]netListed Exvicy C2 domain, also hardcoded in the analyzed JavaScript.
DOMAINcloudflarecapcha[.]comDomain TDR assessed was likely registered by the same operator to host deceptive CAPTCHA pages.
DOMAINconnorkimble[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINdaleeby[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINdi-il[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINdutyfrees[.]digitalListed infrastructure hosting Exvicy administration panels.
DOMAINfamilyonlinestore[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINflarclod[.]topListed Exvicy C2 infrastructure.
DOMAINgardelectricalcontracting[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINgolfcoursetravel[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINgolftucsonarizona[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINhanbayjewellery[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINhestiamortgages[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINid-ll[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINilaumachque[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINinteractivsbroker[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINislamjamal[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINjosephtoone[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINjouncepopdownloadnow[.]comListed Exvicy C2 and administration-panel infrastructure.
DOMAINjumppopdownloadsecret[.]monsterListed Exvicy C2 and administration-panel infrastructure.
DOMAINkawaiininjaclub[.]cfdListed Exvicy C2 and administration-panel infrastructure.
DOMAINlastdayornot[.]topListed Exvicy C2 and administration-panel infrastructure.
DOMAINlaunchingramps[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINleosafari[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINlewdstories[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINlionheadsl[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINlocoaudio[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINlyxorgbs[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINmaidsradar[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINmedfinadvisory[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINnanakshahicoin[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINnewsecuredevice[.]comDomain TDR assessed was likely registered by the same operator to host deceptive CAPTCHA pages.
DOMAINperfectverified[.]comDomain TDR assessed was likely registered by the same operator to host deceptive CAPTCHA pages.
DOMAINphotobyroyan[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINpigeononpinguin[.]topListed infrastructure hosting Exvicy administration panels.
DOMAINploutouscapitalus[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINplumber-charlotte[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINpremiumfastloans[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINprimemarkets360[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINredwing-max[.]bizListed infrastructure hosting Exvicy administration panels.
DOMAINsafetybygrace[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINsanremomodauomo[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINscribblebubblebibi[.]topListed Exvicy C2 infrastructure.
DOMAINsearlepub[.]comListed Exvicy C2 and administration-panel infrastructure.
DOMAINsisaradistributors[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINsocialseoguru[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINsolidfuelsupplier[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINstarbreezehvac[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINstraighteightlogistics[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINsunnypaydayloan[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINsuveniricrnagora[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINtamilarnews[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINthistle-productions[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINtycoonsrow[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINunitedstateverif[.]comDomain TDR assessed was likely registered by the same operator to host deceptive CAPTCHA pages.
DOMAINus-addnewdevice[.]comDomain associated with an Exvicy administration panel and malicious PowerShell downloader.
DOMAINustgate[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINverification-js-cdn[.]boatsC2 domain used by the analyzed ErrTraffic cluster.
DOMAINvirgensantisima[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINvydlje[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINwashingtondc-plumbing[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINwergwee[.]comListed infrastructure hosting Exvicy administration panels.
DOMAINwhirlpoploaderfast[.]comListed Exvicy C2 and administration-panel infrastructure.
DOMAINyuriajonesphotography[.]comListed infrastructure hosting Exvicy administration panels.
IPV4193[.]41[.]68[.]196Listed infrastructure hosting Exvicy administration panels.
IPV42[.]27[.]5[.]165Listed infrastructure hosting Exvicy administration panels.
IPV431[.]76[.]31[.]28Listed infrastructure hosting Exvicy administration panels.
IPV431[.]77[.]228[.]46Listed infrastructure hosting Exvicy administration panels.
IPV465[.]21[.]18[.]60Listed infrastructure hosting Exvicy administration panels.
IPV465[.]21[.]208[.]199Listed infrastructure hosting Exvicy administration panels.
IPV485[.]239[.]144[.]195Listed infrastructure hosting Exvicy administration panels.
IPV485[.]239[.]149[.]13Listed infrastructure hosting Exvicy administration panels.
IPV485[.]239[.]149[.]14Listed infrastructure hosting Exvicy administration panels.
IPV489[.]34[.]90[.]159C2 server receiving installation-status updates from an Exvicy PowerShell downloader.
IPV489[.]34[.]90[.]217Listed infrastructure hosting Exvicy administration panels.
IPV491[.]92[.]33[.]156Listed infrastructure hosting Exvicy administration panels.
IPV491[.]92[.]43[.]245Listed infrastructure hosting Exvicy administration panels.
IPV493[.]152[.]223[.]161Listed infrastructure hosting Exvicy administration panels.
URLhxxp[:]//135[.]181[.]127[.]216/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//151[.]240[.]151[.]8/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//151[.]243[.]113[.]21/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//85[.]239[.]149[.]167/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//87[.]58[.]199[.]76/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//89[.]34[.]90[.]150/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//89[.]34[.]90[.]159/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//91[.]92[.]33[.]213/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//93[.]152[.]224[.]139/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//94[.]26[.]83[.]206/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxp[:]//94[.]26[.]90[.]126Hardcoded Exvicy C2 address in the injected JavaScript payload.
URLhxxp[:]//94[.]26[.]90[.]65/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxps[:]//cloudflare-check[.]netHardcoded Exvicy C2 address in the injected JavaScript payload.
URLhxxps[:]//onlineprivacyprotect[.]com/panelActive Exvicy administration panel identified on 2026-07-09.
URLhxxps[:]//us-addnewdevice[.]comHosted a malicious PowerShell downloader attributed to Exvicy with high confidence.
URLhxxps[:]//us-addnewdevice[.]com/panelSuspected Exvicy administration-panel login page matching the operator's forum screenshots.
URLhxxps[:]//wwwnewdevice[.]org/panelActive Exvicy administration panel identified on 2026-07-09.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationInjected payloads and lure scripts use Base64 encoding, XOR encryption, and randomized JavaScript variable names.T1059.001 · PowerShellThe ClickFix command launches PowerShell to download and execute a remote PowerShell script.T1059.007 · JavaScriptInjected JavaScript decodes and executes the payload, constructs the fake challenge, and communicates with C2.T1071.001 · Web ProtocolsExvicy uses HTTP GET and POST requests to retrieve lure HTML, transmit telemetry, and poll C2 for infection status.T1082 · System Information DiscoveryThe lure collects operating system details and sends them to C2 as part of victim fingerprint data.T1105 · Ingress Tool TransferPowerShell retrieves a remote script; an analyzed downloader also retrieved an MSI installer from a Cloudflare R2 bucket.T1140 · Deobfuscate/Decode Files or InformationThe initial JavaScript deobfuscates its embedded payload before executing it.T1189 · Drive-by CompromiseExvicy JavaScript injected into previously compromised WordPress sites displays malicious ClickFix lures to visitors.T1204.004 · Malicious Copy and PasteThe fake CAPTCHA instructs victims to use Win+R, Ctrl+V, and Enter to paste and execute an attacker-supplied command.

People

Quentin BourgueNamed author of the Exvicy research article.

Threat Actors

@ExvicyRussian-speaking operator advertising and selling the Exvicy framework on Exploit.IN and using the same handle on Telegram.@LenAIIdentified as the seller of ErrTraffic since December 2025.ClearFakeNamed as a ClickFix malware-distribution cluster competing alongside ErrTraffic.IClickFixNamed as a ClickFix malware-distribution cluster competing alongside ErrTraffic.SmartApeSGNamed as a ClickFix malware-distribution cluster competing alongside ErrTraffic.WoodgnatNamed as a ClickFix malware-distribution cluster competing alongside ErrTraffic.

Malware

ErrTrafficExvicy: A copycat of the ErrTraffic malware distribution frameworkExvicyExvicy: A copycat of the ErrTraffic malware distribution framework

Vendors

Cloudflareforum, TDR analysts identified the operator’s C2 infrastructure, ClickFix pages impersonating Cloudflare Turnstile challenges, and compromised WordPress sites used to distribute the framework.DEDIK-IOR2 bucket and sending installation status updates to a C2 server, 89.34.90[.]159 in the AS207043 (DEDIK-IO). The MSI installs the legitimate PuTTY application, an SSH client that provides remote shell access toFewMoreTapsThese domains were registered through FewMoreTaps and PublicDomainRegistry, and they all use TLS certificates issued by Google Trust Services. Given the thematic and lexical similarities in their naming conventionsGoogle Trust Servicesthrough FewMoreTaps and PublicDomainRegistry, and they all use TLS certificates issued by Google Trust Services. Given the thematic and lexical similarities in their naming conventions (e.g. verification,PublicDomainRegistryThese domains were registered through FewMoreTaps and PublicDomainRegistry, and they all use TLS certificates issued by Google Trust Services. Given the thematic and lexical similarities in their naming conventionsSekoiaSekoia's TDR team discovered Exvicy, a new ClickFix malware distribution framework, from a single forum screenshot all the way to its operator's live infrastructure. Here's what we found:

Products

Cloudflare Turnstileforum, TDR analysts identified the operator’s C2 infrastructure, ClickFix pages impersonating Cloudflare Turnstile challenges, and compromised WordPress sites used to distribute the framework.Microsoft Windowsthat the framework he was selling relied on the “Win+R” shortcut rather than “Win+X” (to open the Windows Run dialog box and execute the ClickFix command on the host), adding that he set “the price for thePowerShellpanel associated with ExvicyAdditionally to the matching interface design, we found an obfuscated PowerShell script hosted at hxxps://us-addnewdevice[.]com (urlscan.io's scan of the suspected Exvicy domainPuTTYstatus updates to a C2 server, 89.34.90[.]159 in the AS207043 (DEDIK-IO). The MSI installs the legitimate PuTTY application, an SSH client that provides remote shell access to the host. In the Exploit.IN thread, theSekoia SOC platformSekoia telemetry reveals hosts across multiple Sekoia SOC platform customer environments communicating with Exvicy C2 servers, confirming active adoption by threat actors for malware delivery.WordPressC2 infrastructure, ClickFix pages impersonating Cloudflare Turnstile challenges, and compromised WordPress sites used to distribute the framework.

Countries

Brazil

Related Articles