Sekoia

Exvicy is already widespread in the wild. We identified dozens of active administration panels and more than 100 C2 servers. Its monthly price also jumped from $1,200 to $2,000 in mid-August 2026.

Exvicy reuses ErrTraffic's obfuscated JavaScript, ClickFix HTML, FNV-1a hashing and C2 actions. The main advertised change is the use of Win+R instead of Win+X for the ClickFix command.

Exvicy's affiliates compromise WordPress sites to display a fake Cloudflare Turnstile CAPTCHA in a fullscreen iframe. Victims are told to press Win+R, Ctrl+V, and Enter, executing Base64-encoded PowerShell that drops malware.