Researchers at Sekoia have found that a new criminal rental service for spreading malware through hacked websites is, for the most part, a copy of the rival it set out to compete with. The service is called Exvicy, and Sekoia's Threat Detection and Research team says its JavaScript was lifted almost function for function from ErrTraffic, the framework that has run this corner of the market since December 2025.
Both sell the same trick, known as ClickFix: a web page tells the visitor to prove they are human by pressing a few keys, and those keys paste a command somebody else wrote into Windows and run it. Exvicy's page impersonates a Cloudflare Turnstile check and asks for Win and R, then Ctrl and V, then Enter. That opens the Windows Run box, pastes a PowerShell command already sitting on the clipboard, and executes it. The instructions are translated into 13 languages and chosen automatically from the browser's settings.
A screenshot gave the servers away
Exvicy went on sale on the Russian-speaking forum Exploit.IN on 26 May 2026, in a thread titled "[RENT] CLICKFIX panel for your leads, traffic", posted by a seller using the handle @Exvicy. It started at $1,200 a month. In mid-August the operator raised it to $2,000, writing that "detections are becoming daily". Four forum users vouched for the service.
The advertisement is what undid it. A screenshot of the administration panel showed the operator's own domain hidden behind a white box, but left the pair of Cloudflare nameservers it used in plain view. Sekoia searched for .com domains registered since mid-May that shared that pair and found five. One of them, us-addnewdevice[.]com, was serving a login page identical to the panel in the advertisement, defaulting to Russian with an RU and EN toggle. The same host served an obfuscated PowerShell downloader that pulled an MSI installer from a Cloudflare R2 bucket and reported back to 89[.]34[.]90[.]159. The installer drops PuTTY, a legitimate SSH client that hands the operator a remote shell. Sekoia pivoted from there to 13 more live panels on 9 July.
The same code, minus the blockchain
@Exvicy argued the product was genuinely different because its lure uses Win and R where ErrTraffic uses Win and X. The code comparison in Sekoia's report says otherwise. Both frameworks inject a near identical obfuscated script into compromised WordPress sites, and both carry the same hashing routine to avoid running twice on one machine, the same clipboard function, the same code that blocks the browser's developer tools, and the same request handlers. Sekoia assesses with high confidence that Exvicy's developer reused ErrTraffic's code, either as a paying customer or from a leak, and with medium confidence that both frameworks' injected scripts come out of the same generator.
One real difference stands out. ErrTraffic, sold by the handle @LenAI and the subject of our earlier report, hides its command server address on the Polygon blockchain, where it cannot be taken down. Exvicy hardcodes two servers, hxxps://cloudflare-check[.]net and 94[.]26[.]90[.]126, straight into the script. Cheaper to build, and far easier to block.
Break the chain at the Run box
There is no patch here, because nothing on the victim's machine is being exploited. The user types the command themselves. The controls that bite are the ones that make the Run dialog useless: restricting or logging it through policy, constraining PowerShell to signed scripts, and alerting when a PowerShell process is spawned from the desktop shell rather than from a script or a console. Website owners carry the other half, because Exvicy only reaches anyone through legitimate sites compromised first, the pattern behind the stealers pushed through the Deno runtime in August. Patched plugins and an audit for unexplained JavaScript in page templates remove that delivery layer.
The plagiarism is the more useful finding. ClickFix is now a product category with vendors, price competition and code theft between rivals, so the same lure will keep reappearing under fresh brand names while the script underneath stays recognisable. Detection tuned to a framework's name will spend the next year chasing rebrands. Detection tuned to the behaviour, a web page telling a user to paste something into the Run box, catches the copycat as readily as the original.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.