Exvicy Malware Framework Leverages ErrTraffic Codebase

• •Exvicy is a new ClickFix malware framework based on ErrTraffic's code.
• •The framework is actively used by threat actors for malware delivery via compromised WordPress sites.
• •Subscription prices for Exvicy increased due to heightened detection efforts.

Sekoia's TDR team identified Exvicy, a new ClickFix malware distribution framework, which is a copycat of ErrTraffic. Advertised on the Russian-speaking forum Exploit.IN since May 26, 2026, Exvicy is sold as Malware-as-a-Service (MaaS) and has seen active adoption by threat actors. The framework injects obfuscated JavaScript into compromised WordPress sites, utilizing social engineering tactics to trick victims into executing malicious PowerShell commands. The price for Exvicy's subscription increased from $1,200 to $2,000 due to rising detection rates. Technical analysis confirms that Exvicy reuses ErrTraffic's code, including its JavaScript and Command and Control (C2) communication logic. Sekoia's telemetry indicates multiple customer environments are communicating with Exvicy's C2 servers, confirming its operational use in malware delivery.