Executive Summary
Sekoia TDR analysts have identified Exvicy, a new ClickFix malware distribution framework sold as a Malware-as-a-Service (MaaS) on cybercrime forums like Exploit.IN since May 2026. The framework is operated by a Russian-speaking threat actor known as @Exvicy and serves as a direct competitor to the established ErrTraffic framework. Exvicy primarily targets visitors of compromised WordPress websites, using social engineering lures to trick users into executing malicious payloads on their local systems.
Technical analysis confirms that Exvicy is a copycat of ErrTraffic, reusing significant portions of its client-side JavaScript, obfuscation techniques, and C2 communication logic. The primary differentiator advertised by the operator is the use of the "Win+R" keyboard shortcut to launch the Windows Run dialog box, compared to the "Win+X" method used by ErrTraffic. Once a victim is lured, a PowerShell command is pasted and executed, leading to the installation of secondary payloads such as MSI installers or legitimate tools like PuTTY for remote access.
This threat is actively being adopted by cybercriminals, with telemetry indicating communications between Exvicy C2 infrastructure and various victim environments. The rapid evolution and professionalized support of this MaaS highlight an increasing urgency for organizations to secure WordPress instances and educate users against unconventional social engineering techniques like ClickFix.