A recently identified malware-as-a-service (MaaS) framework named Exvicy has come to light, built upon code borrowed from its competitor, ErrTraffic. This revelation was detailed in a technical report published by the Threat Detection & Research team at Sekoia on September 21. The findings indicate that multiple customer environments have exhibited telemetry showing connections to Exvicy command-and-control (C2) servers, affirming that cybercriminals are actively exploiting this framework to disseminate malware through compromised WordPress sites.
The Exvicy service is humorously marketed by a Russian-speaking individual using the alias “Exvicy.” Since May 26, when it was first publicly advertised on the Exploit.IN forum, the service has seen a significant price increase, from an initial $1,200 per month to $2,000 by mid-August. The operator has reported an uptick in detection rates, claiming that “detections are becoming daily,” reflecting the increasing prominence of this malware framework in the cybercrime landscape.
In response to a user inquiry about the pricing compared to ErrTraffic, which has been available on the same forum since December 2025, the Exvicy seller noted a technical difference; his product utilizes the Win+R shortcut, in contrast to ErrTraffic’s Win+X.
### From a Forum Screenshot to Live Panels
Sekoia’s investigation revealed the operator’s infrastructure through a screenshot included in the forum advertisement. Despite being redacted, the image contained enough identifiable information, such as the length and top-level domain of the admin panel and its Cloudflare nameserver pair, to narrow down the search to five recently registered domains. Among these, one was found to host a login page that was a mirror image of the panel shown in the advertisement. A PowerShell downloader found there fetched a file that matched one from the operator’s payload list, providing a clear link to Exvicy.
Diving deeper, Sekoia’s team discovered 13 additional panels on July 9, and by the end of August, their enumeration of hosts serving the panel had expanded to roughly 80, showcasing the operational scale of Exvicy.
The Exvicy framework operates by injecting obfuscated JavaScript into compromised WordPress sites. This script prompts victims to undergo a faux Cloudflare Turnstile challenge. Users are instructed to press Win+R, paste, and execute a PowerShell command that has already been copied to their clipboard, with instructions available in 13 different languages. Throughout this process, various interactions—including clicking the fake checkbox—are reported back to the operator, affirming that the command has been executed after a three-minute polling period.
### Near-Identical Code, One Real Difference
The Sekoia analysis reveals a high degree of shared coding between Exvicy and ErrTraffic. The report states with high confidence that Exvicy reuses ErrTraffic’s code in both the injected scripts and the lure page. The injected scripts exhibit remarkable similarities, aside from certain encoded payloads and randomized variable names. Additionally, the lure pages share common functions for clipboard management, fingerprinting, anti-analysis mechanisms, and polling functionalities.
Sekoia expressed medium confidence that both Exvicy and ErrTraffic operators utilize the same tools to generate their injected scripts. However, a notable technical difference between the two pertains to their command-and-control strategies. ErrTraffic obscures its C2 address on the Polygon blockchain, employing a technique termed EtherHiding, while Exvicy opts for hardcoding two servers directly into the framework.
The report suggests that the developer behind Exvicy likely acquired ErrTraffic’s source code either as a legitimate customer or through a data breach. The alternative scenario of scraping client-side code from infected websites and reconstructing the backend appears less feasible, as such an endeavor would require effort comparable to creating new code from scratch.
As the malware landscape evolves, the emergence of Exvicy illustrates the ongoing challenges faced by cybersecurity professionals in combating sophisticated and continually adapting threats. The shared codebase and operational similarities between Exvicy and ErrTraffic signal a troubling trend in the cybercrime ecosystem, where the barriers to entry for malicious actors are lowered by existing frameworks and services. With the increasing functionality and reach of services like Exvicy, the potential for cybercriminals to leverage established tools to enhance their operations raises significant concerns about the security of web infrastructure, particularly platforms like WordPress that are commonly compromised.