Exvicy: A copycat of the ErrTraffic malware distribution framework

Sekoia TDR discovered and analyzed Exvicy, a ClickFix malware-as-a-service advertised on Exploit.IN that uses obfuscated JavaScript injected into compromised WordPress sites to display fake Cloudflare Turnstile challenges and socially engineer victims into executing PowerShell droppers; investigators identified Exvicy administration panels, C2 domains and IPs, numerous compromised sites, and numerous IoCs, and concluded the Exvicy client-side codebase is largely reused from the ErrTraffic framework.