ScanMalware.com
Known malicious kitcriticalphishing

ErrTraffic / Exvicy — injected WordPress loader, current minified template (YARA)

family: exvicy-errtraffic-2026-09

The inline loader that ErrTraffic and Exvicy inject into compromised WordPress pages, in the minified form seen from late August 2026: a Base64 blob XOR-decoded character by character and run through new Function. Only the variable names, the key and the blob change between sites.

Anchors

YARA ruleErrTraffic_Exvicy_WordPress_Injected_Loader_V2

Provenance

Added: 2026-09-23 13:50
Structural match on the page itself, independent of which command-and-control domain the site currently points at.
References:

Sightings (50)

HostScanScriptMatchWhen
sohonailbar.es#html3e153c90…https://sohonailbar.es#htmlyara2026-09-23 13:50
www.actingandvoice.co.uk#html8697faba…https://www.actingandvoice.co.uk#htmlyara2026-09-23 13:50
multi-sweep.com#html5d371917…https://multi-sweep.com#htmlyara2026-09-23 13:50
elegancedrycleaner.com#htmlded364de…https://elegancedrycleaner.com#htmlyara2026-09-23 13:50
www.ablecasinos.com#htmlc54eadc9…https://www.ablecasinos.com#htmlyara2026-09-23 13:50
diplomatmontessori.co.za#htmldc0bdc1c…https://diplomatmontessori.co.za#htmlyara2026-09-23 13:50
institutovitoria.com#htmld7ab09ea…https://institutovitoria.com#htmlyara2026-09-23 13:50
www.actingandvoice.co.uk#html01cd7273…https://www.actingandvoice.co.uk#htmlyara2026-09-23 13:50
6gems.gr#html633fc7b7…https://6gems.gr#htmlyara2026-09-23 13:50
tecnogermana.com#html444ecfbf…https://tecnogermana.com#htmlyara2026-09-23 13:50
acmbio.es#htmlcef193d6…https://acmbio.es#htmlyara2026-09-23 13:50
harapouya.ir#html4af84455…https://harapouya.ir#htmlyara2026-09-23 13:50
diabetescareth.com#html15c8216c…https://diabetescareth.com#htmlyara2026-09-23 13:50
maryolanieto.com#html7a185661…https://maryolanieto.com#htmlyara2026-09-23 13:50
fahrschule-heidisch.de#html76d31efb…https://fahrschule-heidisch.de#htmlyara2026-09-23 13:50
laboriewines.co.za#html31cfdb72…https://laboriewines.co.za#htmlyara2026-09-23 13:50
www.condominiojavieracarrera.cl#htmla4a304ea…https://www.condominiojavieracarrera.cl#htmlyara2026-09-23 13:50
contentcareer.com#html8cb96fe2…https://contentcareer.com#htmlyara2026-09-23 13:50
browningconsultingtexas.com#htmlb11194ac…https://browningconsultingtexas.com#htmlyara2026-09-23 13:50
americanalliancemg.com#htmlbe174b8f…https://americanalliancemg.com#htmlyara2026-09-23 13:50
www.vgavoile.org#htmld49c69df…https://www.vgavoile.org#htmlyara2026-09-23 13:50
longitudeconstruction.com#htmle8c7b1b7…https://longitudeconstruction.com#htmlyara2026-09-23 13:50
vtsc.asia#htmlf37225d1…https://vtsc.asia#htmlyara2026-09-23 13:50
dolceitalia.org#html1df3fce5…https://dolceitalia.org#htmlyara2026-09-23 13:50
noticias29.com#htmla9de6622…https://noticias29.com#htmlyara2026-09-23 13:50
sebikft.hu#html2be577cd…https://sebikft.hu#htmlyara2026-09-23 13:50
stampa70.com#html9bebfbcc…https://stampa70.com#htmlyara2026-09-23 13:50
kingdomdoghotel.com#html5ff0d4d4…https://kingdomdoghotel.com#htmlyara2026-09-23 13:50
depannage-rideaux-metalliques-91.com#htmlc685e4d6…https://depannage-rideaux-metalliques-91.com#htmlyara2026-09-23 13:50
heartandshape.com#html1e118494…https://heartandshape.com#htmlyara2026-09-23 13:50
davariyabrothers.com#html09d57c04…https://davariyabrothers.com#htmlyara2026-09-23 13:50
andrewsenterprises.org#html803bd6ef…https://andrewsenterprises.org#htmlyara2026-09-23 13:50
stratumrs.com#htmlccb16a2d…https://stratumrs.com#htmlyara2026-09-23 13:50
opel-hoefler.de#htmle4697c82…https://opel-hoefler.de#htmlyara2026-09-23 13:50
eastmont.net#html06705a67…https://eastmont.net#htmlyara2026-09-23 13:50
newdigimatic.com#htmld49e3ae6…https://newdigimatic.com#htmlyara2026-09-23 13:50
lexperts-comptables.com#html1f82bdc7…https://lexperts-comptables.com#htmlyara2026-09-23 13:50
navscorp.com#htmld2b7d891…https://navscorp.com#htmlyara2026-09-23 13:50
glowbeautybd.com#html3b98b242…https://glowbeautybd.com#htmlyara2026-09-23 13:50
greenova.app#html89c2699d…https://greenova.app#htmlyara2026-09-23 13:50
airbnblistingservice.com#html00e436bd…https://airbnblistingservice.com#htmlyara2026-09-23 13:50
globalpath.net#html2ae14a48…https://globalpath.net#htmlyara2026-09-23 13:50
realizimmo.be#htmld8f168cc…https://realizimmo.be#htmlyara2026-09-23 13:50
stcconsulting.fr#html5d9add2b…https://stcconsulting.fr#htmlyara2026-09-23 13:50
macroad.it#htmla7182413…https://macroad.it#htmlyara2026-09-23 13:50
kohatpromotions.com#htmlca791ac9…https://kohatpromotions.com#htmlyara2026-09-23 13:50
lmohphotography.com#html7246fc5e…https://lmohphotography.com#htmlyara2026-09-23 13:50
peatsorbng.azurewebsites.net#html4f76c152…https://peatsorbng.azurewebsites.net#htmlyara2026-09-23 13:50
gaviticonsulting.com#html84c82561…https://gaviticonsulting.com#htmlyara2026-09-23 13:50
medmark.sa#htmlb3dcaa07…https://medmark.sa#htmlyara2026-09-23 13:50