Copycat ClickFix Kit Built on Rival's Code

A new ClickFix malware-as-a-service framework called Exvicy is built on code copied from a rival service, according to threat researchers who traced its infrastructure from a single forum screenshot to roughly 80 active hosts in a matter of weeks. The operators are already selling it on Exploit.IN, and telemetry shows real victims.

Built on a Rival's Code

Sekoia's Threat Detection & Research team published a technical write-up assessing with high confidence that Exvicy reuses ErrTraffic's code in both its injected script and its lure page. Beyond encoded payloads and randomized variable names, the injected scripts are nearly identical, and the lure pages share the same clipboard, fingerprinting, anti-analysis and polling functions.

The team assessed with medium confidence that both operators use the same tool to generate the injected scripts. The clearest technical difference between the two is not the keyboard shortcut. ErrTraffic hides its command-and-control address on the Polygon blockchain, a technique known as EtherHiding, while Exvicy hardcodes two servers instead.

Sekoia said Exvicy's developer most likely obtained ErrTraffic's source code, either as a paying customer or through a leak. Scraping the client-side code from infected sites and rebuilding the backend was less plausible, the researchers argued, since that would take as much effort as writing new code itself.

From a Forum Screenshot to Live Panels

The seller, a Russian-speaking actor using the handle Exvicy, has advertised the MaaS on Exploit.IN since May 26. It launched at $1,200 a month and rose to $2,000 in mid-August, with the operator claiming "detections are becoming daily."

When a forum user questioned the price against ErrTraffic, sold on the same forum since December 2025, the seller said his product relied on the Win+R shortcut rather than ErrTraffic's Win+X.

Sekoia found the operator's infrastructure through a screenshot in the advert itself. A redacted domain in the admin panel still showed its length, top-level domain and Cloudflare nameserver pair, which narrowed the search to five recently registered domains. One hosted a login page identical to the panel in the screenshot, and a PowerShell downloader there fetched a file matching one in the operator's own payload list. Pivoting from that panel turned up 13 more on July 9, and by late August Sekoia's list of hosts serving the panel ran to about 80.

How the Lure Reels Them In

The framework injects obfuscated JavaScript into compromised WordPress sites, which loads a fake Cloudflare Turnstile check. Victims are told to press Win+R, paste and press Enter, running a PowerShell command already copied to their clipboard, with instructions in 13 languages.

The page reports each step back to the operator, including when the victim clicks the fake checkbox, then polls for three minutes to confirm the command ran. According to the write-up, telemetry from multiple customer environments showed hosts communicating with Exvicy command-and-control servers — confirming threat actors are using it to deliver malware through compromised WordPress sites.

Two Services, One Playbook

ErrTraffic has been sold on the same forum since December 2025. Exvicy's operator defended his higher price by pointing to the Win+R shortcut instead of Win+X, but the underlying mechanics are largely the same. The near-identical code and shared lure-page functions suggest the two services are drawing from the same development lineage, even as their operators compete for buyers.

The one real infrastructural split is how each hides its C2. ErrTraffic's use of EtherHiding places its address on the Polygon blockchain; Exvicy's hardcoded servers make it easier for defenders to block once discovered.

Roughly 80 Hosts Serving the Panel

From five candidate domains in the advert's screenshot to 13 more found on July 9, Sekoia's list of hosts serving the Exvicy panel reached about 80 by late August. That growth curve suggests the operator is actively spinning up infrastructure, not just reselling a static kit.

Because the lure relies on victims running the command themselves, detection can hinge on endpoint telemetry rather than a single malicious file hash. The fake Turnstile page's step-by-step reporting and three-minute confirmation poll give the operator a feedback loop on which lures are working.

Why the Copycat Matters

ClickFix-style attacks have become a popular delivery technique, and a cheaper copy of an established framework lowers the barrier for less-skilled operators. A single source — Sekoia's write-up — is behind the assessment that Exvicy reuses ErrTraffic's code and is live in customer environments. The researchers' high-confidence call on code reuse is supported by the near-identical scripts and shared functions, while the source-code acquisition theory carries medium confidence.

For defenders, the practical takeaway is that blocking one MaaS brand does not remove the playbook. The lure pages share fingerprinting and anti-analysis functions, and the injected scripts use randomized variable names and encoded payloads, so signature-based rules may struggle. Security teams could look for the specific sequence of a fake Turnstile checkbox followed by a Win+R instruction and a clipboard-injected PowerShell command, and monitor for hosts polling the operator's panel.

The episode also shows how quickly an operator can go from a forum advert to dozens of live hosts. Buyers pay by the month, with prices rising as the seller claims daily detections — a signal that the service is finding victims, not just generating noise.