New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code
A new Malware-as-a-Service (MaaS) framework named Exvicy has been identified, built upon reused code from a competing service, ErrTraffic, highlighting code sharing among threat actors.
A novel Malware-as-a-Service (MaaS) framework, dubbed Exvicy, has emerged on the threat landscape, distinguished by its foundation built upon code repurposed from a rival service known as ErrTraffic. Security researchers from Sekoia's Threat Detection & Research team observed telemetry indicating active use of Exvicy command-and-control (C2) servers, confirming its deployment by threat actors to distribute malware via compromised WordPress websites.
The Exvicy MaaS platform is operated by a Russian-speaking actor using the handle "Exvicy," who began advertising the service on the Exploit.IN forum in late May 2026. Initially priced at $1,200 per month, the cost increased to $2,000 by mid-August, with the operator boasting about daily detection rates. When questioned by a forum user about its pricing relative to ErrTraffic, which has been available on the same forum since December 2025, the Exvicy operator highlighted a technical distinction: Exvicy utilizes the Win+R shortcut, whereas ErrTraffic employs Win+X.
Sekoia's investigation into Exvicy's infrastructure began with a screenshot provided in the service's advertisement. By analyzing a redacted domain name within the admin panel, researchers were able to narrow down the search to five recently registered domains. One of these domains hosted a login page that was identical to the one shown in the advertisement. Further analysis of a PowerShell downloader found on this page revealed a file that matched one from the operator's own payload list. This pivot led to the discovery of 13 additional Exvicy panels on July 9, and by late August, Sekoia had identified approximately 80 hosts serving the Exvicy panel.
The Exvicy framework operates by injecting obfuscated JavaScript code into compromised WordPress sites. This malicious script then loads a deceptive Cloudflare Turnstile check. Victims are prompted to press the Win+R shortcut, paste a command into the run dialog, and execute it. The command, already copied to their clipboard, is presented with instructions in one of 13 languages. The lure page meticulously reports each user interaction back to the operator, including the click on the fake checkbox, and then polls for three minutes to confirm the execution of the command.
Sekoia's analysis concluded with high confidence that Exvicy extensively reuses code from ErrTraffic, evident in both the injected scripts and the lure pages. Beyond superficial changes like encoded payloads and randomized variable names, the injected scripts are nearly identical. The lure pages share common functionalities for clipboard management, fingerprinting, anti-analysis techniques, and polling mechanisms. This level of code reuse strongly suggests a direct lineage or shared development.
With medium confidence, Sekoia assessed that both operators likely employ the same tool for generating the injected scripts. The most significant technical divergence between the two services, beyond the shortcut used, lies in their command-and-control (C2) infrastructure. ErrTraffic employs a technique known as "EtherHiding" to conceal its C2 addresses on the Polygon blockchain, a method designed for resilience. In contrast, Exvicy hardcodes two C2 server addresses directly into its framework.
Researchers posit that the Exvicy developer most likely obtained the source code of ErrTraffic, either by being a paying customer of the service or through a potential code leak. The alternative scenario, where the developer scraped client-side code from infected sites and rebuilt the backend, is considered less plausible. Such an undertaking would likely require as much effort as developing entirely new code, making direct access to or leakage of the source code a more probable explanation for the extensive code reuse observed.
This discovery underscores a concerning trend within the MaaS ecosystem: the repurposing and sharing of code among threat actors. This practice can accelerate the development and deployment of new malicious tools, making it more challenging for security vendors to keep pace. The reuse of established codebases, particularly those with known functionalities and evasion techniques, can lower the barrier to entry for aspiring cybercriminals and potentially increase the effectiveness of their campaigns.