Exvicy/ErrTraffic ClickFix C2 api.php check-in POST

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•2

Detects HTTP POST requests directed to the '/api.php' endpoint with specific patterns characteristic of Exvicy/ClickFix malware C2 communication. The rule identifies suspicious action parameters (check, dl, or cb) and a specific 48-character hexadecimal 'k' parameter used for identifying infected state.