ScanMalware.com
Known malicious kitcriticalphishing

ErrTraffic / Exvicy — injected WordPress loader, current minified template (YARA)

family: exvicy-errtraffic-2026-09

The inline loader that ErrTraffic and Exvicy inject into compromised WordPress pages, in the minified form seen from late August 2026: a Base64 blob XOR-decoded character by character and run through new Function. Only the variable names, the key and the blob change between sites.

Anchors

YARA ruleErrTraffic_Exvicy_WordPress_Injected_Loader_V2

Provenance

Added: 2026-09-23 13:50
Structural match on the page itself, independent of which command-and-control domain the site currently points at.
References:

Sightings (109)

HostScanScriptMatchWhen
stilt.com1af2798f…https://stilt.com/wp-content/plugins/cgt-blocks/blocks/src/attributestyle.js?ver=1.0.1yara2026-10-06 19:02
www.legendcup.net7483544c…https://www.legendcup.net/#htmlyara2026-10-04 10:27
lovezramexar.info8b9fe84d…https://lovezramexar.info/api.php?s=ced0099d6a5f39773904c85db6aa53b1d5466ea62a8f3fff&_v=29851825yara2026-10-04 10:27
lovezramexar.info8b9fe84d…https://lovezramexar.info/api.php?s=ced0099d6a5f39773904c85db6aa53b1d5466ea62a8f3fff&_v=29851826yara2026-10-04 10:27
www.leroyfortin.fr8b9fe84d…https://www.leroyfortin.fr/#htmlyara2026-10-04 10:27
www.manini.fr297b30a5…https://www.manini.fr/#htmlyara2026-10-04 10:26
louisstructures.com12514fea…https://louisstructures.com/wp-content/plugins/metform/public/assets/lib/cute-alert/cute-alert.js?ver=4.0.7yara2026-10-04 10:26
www.marquecreative.comaf6bcd59…https://www.marquecreative.com/#htmlyara2026-10-04 10:26
zetaclinic.it6e24e3ab…https://zetaclinic.it/wp-content/plugins/js_composer/assets/lib/vc_waypoints/vc-waypoints.min.js?ver=6.8.0yara2026-10-04 04:28
zetaclinic.it6e24e3ab…https://zetaclinic.it/wp-content/plugins/timetable/js/jquery.ba-bbq.min.js?ver=7.1.2yara2026-10-04 04:28
zetaclinic.it6e24e3ab…https://zetaclinic.it/#htmlyara2026-10-04 04:28
www.247productions.nld54cfa19…https://www.247productions.nl/wp-content/plugins/gallery-by-supsystic/src/GridGallery/Colorbox/jquery-colorbox/jquery.colorbox.js?ver=1.15.13yara2026-10-04 04:27
6gems.gr9ac4a2bd…https://6gems.gr/#htmlyara2026-10-04 04:27
www.247productions.nld54cfa19…https://www.247productions.nl/#htmlyara2026-10-04 04:27
www.expeditrans.org13acd1c9…https://www.expeditrans.org/#htmlyara2026-10-04 04:26
firstcallkuwait.com#html18888b6c…https://firstcallkuwait.com#htmlyara2026-10-04 03:21
fullpowerproperties.uk327dfa14…https://fullpowerproperties.uk/wp-content/plugins/elementor/assets/lib/swiper/v8/swiper.min.js?ver=8.4.5yara2026-10-03 10:27
fullpowerproperties.uk327dfa14…https://fullpowerproperties.uk/wp-content/plugins/elementskit-lite/libs/framework/assets/js/frontend-script.js?ver=3.7.6yara2026-10-03 10:27
www.azerichess.comd590a980…https://www.azerichess.com/#htmlyara2026-10-03 10:27
www.bilisimzamani.net0b671725…https://www.bilisimzamani.net/#htmlyara2026-10-03 10:26
flouz.agency37ab0ebd…https://flouz.agency/#htmlyara2026-10-03 04:28
arrebolcap.com157b78c7…https://arrebolcap.com/#htmlyara2026-10-03 04:27
theficobooster.com017b752f…https://theficobooster.com/wp-content/themes/solvency/assets/js/jquery.magnific-popup.min.js?ver=20151215yara2026-10-03 04:26
sna247supportservices.org8c0914b2…https://sna247supportservices.org/#htmlyara2026-10-03 04:25
irvincap.com909ce65b…https://irvincap.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.6.1yara2026-10-02 10:28
easystudytr.neta81b8ba8…https://easystudytr.net/#htmlyara2026-10-02 10:28
irvincap.com909ce65b…https://irvincap.com/#htmlyara2026-10-02 10:28
www.astuces-deco.pro41fe925d…https://www.astuces-deco.pro/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.16.5yara2026-10-02 10:27
www.bagagliculinari.itdfc75d24…http://www.bagagliculinari.it/#htmlyara2026-10-02 10:27
usercontent.one70fa9a70…https://usercontent.one/wp/www.martaolcina.es/wp-content/themes/pofo/assets/js/jquery.fitvids.js?ver=1.1yara2026-10-02 10:27
www.astuces-deco.pro41fe925d…https://www.astuces-deco.pro/#htmlyara2026-10-02 10:27
www.bishopsglass.co.uk87546abe…https://www.bishopsglass.co.uk/#htmlyara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/themes/newsmatic/assets/lib/waypoint/jquery.waypoint.min.js?ver=4.0.1yara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/themes/newsmatic/assets/js/theme.js?ver=1.3.10yara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/themes/newsmatic/assets/js/navigation.js?ver=1.3.10yara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/themes/newsmatic/assets/lib/jquery-cookie/jquery-cookie.js?ver=1.4.1yara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/themes/newsmatic/assets/lib/slick/slick.min.js?ver=1.8.1yara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/plugins/breeze/assets/js/js-front-end/breeze-prefetch-links.min.js?ver=2.1.9yara2026-10-02 04:26
www.bigtonypoker.com49831af8…https://www.bigtonypoker.com/wp-content/themes/newsmatic/assets/lib/js-marquee/jquery.marquee.min.js?ver=1.6.0yara2026-10-02 04:26
www.bestforme.netcc189a02…https://www.bestforme.net/#htmlyara2026-10-02 04:26
bflyarn.comc34d29c9…https://bflyarn.com/#htmlyara2026-10-02 04:26
www.bettingspeak.comf6dd2d52…https://www.bettingspeak.com/#htmlyara2026-10-02 04:25
vanderbilt-park.com7e33ebe2…https://vanderbilt-park.com/#htmlyara2026-10-01 16:27
lovezramexar.info3bfbfb15…https://lovezramexar.info/api.php?s=4a67ef89c0c750abf170c83e5a5922de63802862343d2c6b&_v=29847865yara2026-10-01 16:26
lovezramexar.info3bfbfb15…https://lovezramexar.info/api.php?s=4a67ef89c0c750abf170c83e5a5922de63802862343d2c6b&_v=29847866yara2026-10-01 16:26
unitranscond.com3c021bb6…https://unitranscond.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.min.js?ver=1.2.1yara2026-10-01 16:26
velti-digital.com3bfbfb15…https://velti-digital.com/#htmlyara2026-10-01 16:26
unitranscond.com3c021bb6…https://unitranscond.com/#htmlyara2026-10-01 16:26
diabetescareth.com28812a0f…https://diabetescareth.com/wp-content/plugins/set-api-blocks/blocks/src/attributestyle.js?ver=1.0.1yara2026-10-01 13:37
diabetescareth.com28812a0f…https://diabetescareth.com/#htmlyara2026-10-01 13:37
solarcapricornio.com.br429f6353…https://solarcapricornio.com.br/wp-content/cache/autoptimize/js/autoptimize_single_bb319cbeaa3e7055031046fd85716585.js?ver=1.0.0yara2026-10-01 13:08
solarcapricornio.com.br429f6353…https://solarcapricornio.com.br/#htmlyara2026-10-01 13:08
checkgps.comb88089c7…https://checkgps.com/#htmlyara2026-10-01 13:07
lovezramexar.infoeccec11e…https://lovezramexar.info/api.php?s=4a67ef89c0c750abf170c83e5a5922de63802862343d2c6b&_v=29847665yara2026-10-01 13:06
lovezramexar.infoeccec11e…https://lovezramexar.info/api.php?s=4a67ef89c0c750abf170c83e5a5922de63802862343d2c6b&_v=29847666yara2026-10-01 13:06
solarcameratrailer.com8e0c38e6…https://solarcameratrailer.com/#htmlyara2026-10-01 13:06
sportorium.ptumb.combdb6c975…https://sportorium.ptumb.com/wp-content/plugins/elementor-pro/assets/js/page-transitions.min.js?ver=3.7.7yara2026-10-01 13:06
18.208.215.155eccec11e…https://18.208.215.155/#htmlyara2026-10-01 13:06
dein-sandmann.de46847c39…https://dein-sandmann.de/#htmlyara2026-10-01 13:05
sohonailbar.es#html3e153c90…https://sohonailbar.es#htmlyara2026-09-23 13:50
www.actingandvoice.co.uk#html8697faba…https://www.actingandvoice.co.uk#htmlyara2026-09-23 13:50
multi-sweep.com#html5d371917…https://multi-sweep.com#htmlyara2026-09-23 13:50
elegancedrycleaner.com#htmlded364de…https://elegancedrycleaner.com#htmlyara2026-09-23 13:50
www.ablecasinos.com#htmlc54eadc9…https://www.ablecasinos.com#htmlyara2026-09-23 13:50
diplomatmontessori.co.za#htmldc0bdc1c…https://diplomatmontessori.co.za#htmlyara2026-09-23 13:50
institutovitoria.com#htmld7ab09ea…https://institutovitoria.com#htmlyara2026-09-23 13:50
www.actingandvoice.co.uk#html01cd7273…https://www.actingandvoice.co.uk#htmlyara2026-09-23 13:50
6gems.gr#html633fc7b7…https://6gems.gr#htmlyara2026-09-23 13:50
tecnogermana.com#html444ecfbf…https://tecnogermana.com#htmlyara2026-09-23 13:50
acmbio.es#htmlcef193d6…https://acmbio.es#htmlyara2026-09-23 13:50
harapouya.ir#html4af84455…https://harapouya.ir#htmlyara2026-09-23 13:50
diabetescareth.com#html15c8216c…https://diabetescareth.com#htmlyara2026-09-23 13:50
maryolanieto.com#html7a185661…https://maryolanieto.com#htmlyara2026-09-23 13:50
fahrschule-heidisch.de#html76d31efb…https://fahrschule-heidisch.de#htmlyara2026-09-23 13:50
laboriewines.co.za#html31cfdb72…https://laboriewines.co.za#htmlyara2026-09-23 13:50
www.condominiojavieracarrera.cl#htmla4a304ea…https://www.condominiojavieracarrera.cl#htmlyara2026-09-23 13:50
contentcareer.com#html8cb96fe2…https://contentcareer.com#htmlyara2026-09-23 13:50
browningconsultingtexas.com#htmlb11194ac…https://browningconsultingtexas.com#htmlyara2026-09-23 13:50
americanalliancemg.com#htmlbe174b8f…https://americanalliancemg.com#htmlyara2026-09-23 13:50
www.vgavoile.org#htmld49c69df…https://www.vgavoile.org#htmlyara2026-09-23 13:50
longitudeconstruction.com#htmle8c7b1b7…https://longitudeconstruction.com#htmlyara2026-09-23 13:50
vtsc.asia#htmlf37225d1…https://vtsc.asia#htmlyara2026-09-23 13:50
dolceitalia.org#html1df3fce5…https://dolceitalia.org#htmlyara2026-09-23 13:50
noticias29.com#htmla9de6622…https://noticias29.com#htmlyara2026-09-23 13:50
sebikft.hu#html2be577cd…https://sebikft.hu#htmlyara2026-09-23 13:50
stampa70.com#html9bebfbcc…https://stampa70.com#htmlyara2026-09-23 13:50
kingdomdoghotel.com#html5ff0d4d4…https://kingdomdoghotel.com#htmlyara2026-09-23 13:50
depannage-rideaux-metalliques-91.com#htmlc685e4d6…https://depannage-rideaux-metalliques-91.com#htmlyara2026-09-23 13:50
heartandshape.com#html1e118494…https://heartandshape.com#htmlyara2026-09-23 13:50
davariyabrothers.com#html09d57c04…https://davariyabrothers.com#htmlyara2026-09-23 13:50
andrewsenterprises.org#html803bd6ef…https://andrewsenterprises.org#htmlyara2026-09-23 13:50
stratumrs.com#htmlccb16a2d…https://stratumrs.com#htmlyara2026-09-23 13:50
opel-hoefler.de#htmle4697c82…https://opel-hoefler.de#htmlyara2026-09-23 13:50
eastmont.net#html06705a67…https://eastmont.net#htmlyara2026-09-23 13:50
newdigimatic.com#htmld49e3ae6…https://newdigimatic.com#htmlyara2026-09-23 13:50
lexperts-comptables.com#html1f82bdc7…https://lexperts-comptables.com#htmlyara2026-09-23 13:50
navscorp.com#htmld2b7d891…https://navscorp.com#htmlyara2026-09-23 13:50
glowbeautybd.com#html3b98b242…https://glowbeautybd.com#htmlyara2026-09-23 13:50
greenova.app#html89c2699d…https://greenova.app#htmlyara2026-09-23 13:50
airbnblistingservice.com#html00e436bd…https://airbnblistingservice.com#htmlyara2026-09-23 13:50
globalpath.net#html2ae14a48…https://globalpath.net#htmlyara2026-09-23 13:50
realizimmo.be#htmld8f168cc…https://realizimmo.be#htmlyara2026-09-23 13:50
stcconsulting.fr#html5d9add2b…https://stcconsulting.fr#htmlyara2026-09-23 13:50
macroad.it#htmla7182413…https://macroad.it#htmlyara2026-09-23 13:50
kohatpromotions.com#htmlca791ac9…https://kohatpromotions.com#htmlyara2026-09-23 13:50
lmohphotography.com#html7246fc5e…https://lmohphotography.com#htmlyara2026-09-23 13:50
peatsorbng.azurewebsites.net#html4f76c152…https://peatsorbng.azurewebsites.net#htmlyara2026-09-23 13:50
gaviticonsulting.com#html84c82561…https://gaviticonsulting.com#htmlyara2026-09-23 13:50
medmark.sa#htmlb3dcaa07…https://medmark.sa#htmlyara2026-09-23 13:50