Exvicy C2 /api.php dl/cb/check ClickFix polling protocol

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

Detects HTTP beaconing and command-and-control (C2) communication patterns associated with the Exvicy malware family. This includes heartbeat polling, victim fingerprinting registration, and CAPTCHA handling over HTTP GET and POST requests to the '/api.php' endpoint.