Analista de Seguridad: 2026-09-22

1. Exvicy: A copycat of the ErrTraffic malware distribution framework

   Sekoia, 2026-09-21. Leer, 19 min.

   Sekoia’s Threat Detection and Research team describes Exvicy, a ClickFix malware-distribution framework sold as a service and advertised on Exploit.IN since 26 May 2026, whose pages impersonate a Cloudflare Turnstile challenge and are delivered through compromised WordPress sites. It assesses with high confidence that Exvicy is a copycat of ErrTraffic, reusing its injected JavaScript and nearly identical C2 workflows while its ClickFix lure differs (Turnstile and Win+R, not reCAPTCHA and Win+X), and says its telemetry shows hosts in multiple customer environments contacting Exvicy C2 servers.

   Por qué importa para este rol: You triage what the environment surfaces, so recognizing Exvicy’s Cloudflare Turnstile ClickFix lure and its reuse of ErrTraffic code helps you tie an alert to a known framework rather than treat it as new.

2. BigCommerce alerts merchants of data breach linked to Ribon apps

   BleepingComputer, 2026-09-21. Leer, 3 min.

   BigCommerce told BleepingComputer that on September 17, 2026 it confirmed that credentials for the third-party Ribon and Ribon 1.5 apps, run by Be A Part Of, a Fastr company, had been compromised and used to inject malicious scripts into a small number of merchant storefronts, and that it removed the apps and notified those merchants. Master of Malt, one notified merchant, says the attacker reached shopper names, emails, phone numbers, and shipping addresses between September 13 and 17, while BigCommerce says its own platform was not breached and card data was not exposed.

   Por qué importa para este rol: When shopper-data alerts or complaints reach your queue, this case shows the entry point may be a compromised third-party app credential rather than the storefront itself, which changes where you look first.

3. TerminalFix: PNG Steganography

   SANS Internet Storm Center, 2026-09-21. Leer, 4 min.

   Didier Stevens, writing for the SANS Internet Storm Center, analyzed the PNG files from the TerminalFix campaign that Microsoft Security Research described and found they are valid PNG images with no appended data or metadata, so the payload hides in the pixel data itself. The first image carries a genuine Microsoft executable, LockScreenContentServer.exe, used for sideloading, and two further images hold a malicious DLL split in two parts, with the actors using all of the available bits so the original image is lost when rendered.

   Por qué importa para este rol: Payloads hidden in valid PNG files slip past checks that look for appended data or odd metadata, so this analysis shows you what to examine when an image is the suspicious artifact.

Analista de Seguridad