Exvicy ClickFix embed fetch to hardcoded C2 (cloudflare-check.net)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects network traffic associated with the Exvicy malware delivery chain. The rule identifies two behaviors: first, HTTP GET requests to a '/embed/' endpoint with specific 'embed=1' and 'host=cloudflare-check.net' parameters, and second, established TCP connections to a known command and control (C2) IP address related to the ClickFix social engineering delivery method.