Security1 publisher2 min readPublished
Exvicy built its ClickFix subscription on code lifted from rival ErrTraffic
Sekoia's comparison found the two ClickFix services' injected scripts near identical, while the Exvicy subscription climbed from $1,200 to $2,000 a month and its panel count reached about 80 hosts by late August.
The Watch · Security desk
What happened
- Sekoia's September 21 write-up says telemetry from multiple customer environments showed hosts talking to Exvicy command-and-control servers, delivering malware through compromised WordPress sites.
- A Russian-speaking seller has advertised the Exvicy service on the Exploit.IN forum since May 26, launching at $1,200 a month and raising the price to $2,000 in mid-August.
- Sekoia assessed with high confidence that Exvicy reuses rival ErrTraffic's code in both the injected script and the lure page, near identical beyond encoded payloads and randomized variable names.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability The two services' lure pages share clipboard, fingerprinting, anti-analysis and polling functions, so one signature written against those functions covers both vendors' campaigns instead of one seller's.
- constraint A detection keyed to Run-dialog activity from Win+R catches Exvicy's buyers and leaves ErrTraffic's, who push victims through Win+X, running unnoticed.
- decision Exvicy's two hardcoded C2 servers can be blocked at the network edge; ErrTraffic's blockchain-resolved channel cannot, which pushes defenders facing it toward endpoint detection of the clipboard-to-PowerShell sequence.
- precedent If ClickFix vendors are buying or leaking each other's source, code similarity stops separating families and starts grouping customers of the same builder.
At $1,200 a month at launch and $2,000 by mid-August, the Exvicy subscription rose about 67 percent [4][1] in under three months [4]. At the current price a buyer pays $24,000 a year [2]. A forum user asked why it cost more than ErrTraffic, which has sold on the same forum since December 2025 [7]. The seller's answer was the keyboard shortcut: his product uses Win+R, ErrTraffic uses Win+X [6]. The operator also said "detections are becoming daily" [5].
What the buyer gets starts with obfuscated JavaScript injected into a compromised WordPress site, loading a fake Cloudflare Turnstile check [11]. The page tells the victim to press Win+R, paste and press Enter. The PowerShell command is already on the clipboard, and the instructions come in 13 languages [11]. Each step is reported back to the operator, including the click on the fake checkbox, and the page then polls for three minutes to confirm the command ran [12]. The operator therefore learns within minutes which victims executed, so what the subscription sells is confirmed execution.
The two services diverge at the command channel. ErrTraffic hides its C2 address on the Polygon blockchain, the technique known as EtherHiding, while Exvicy hardcodes two servers [16]. Sekoia also assessed with medium confidence that both operators generate their injected scripts with the same tool [15].
The operator's mistake was in his own advert. The screenshot of the admin panel carried a redacted domain, but the redaction preserved the string length, the top-level domain and the Cloudflare nameserver pair. That narrowed the search to five recently registered domains [8]. One served a login page identical to the screenshot, and a PowerShell downloader hosted there fetched a file matching an entry in the operator's own payload list [9]. Pivoting from that panel turned up 13 more on July 9, and by late August Sekoia's list of hosts serving the panel ran to about 80 [10], roughly six times the July count in about seven weeks [3].
Sekoia said Exvicy's developer most likely obtained ErrTraffic's source code, either as a paying customer or through a leak, and judged scraping the client-side code off infected sites less plausible because rebuilding the backend would take as much effort as writing new code [17].
What to watch
- Whether ErrTraffic's operator answers the code-theft finding on Exploit.IN, and whether either listing stays up.