Exvicy ClickFix embed callback to C2 via /embed URI pattern

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•0

Detects network indicators associated with the Exvicy ClickFix campaign, including HTTP callbacks to embed endpoints, DNS queries for the 'cloudflare-check.net' domain, direct connections to the identified C2 IP address (94.26.90.126), and HTTP responses containing fake 'Security Check' iframe content.