As cited
Copy frozen at (site build).
threat intel
ClickFix Evolves with PySoxy Proxying
ReliaQuest researchers observed a ClickFix campaign that evolved beyond one-time user execution to establish persistent access using scheduled tasks and PySoxy, an open-source Python SOCKS5 proxy tool. After a user executed a malicious PowerShell command from a compromised website, the attacker deployed a PowerShell-based command-and-control channel, domain reconnaissance, and a secondary encrypted proxy path through PySoxy, creating a durable intrusion that continued attempting to re-execute even after initial outbound connections were blocked. This represents the first observed combination of ClickFix with PySoxy, demonstrating how attackers are layering older open-source tools to establish redundant access paths that are harder to detect and contain.
Why it matters: Security teams investigating ClickFix incidents must treat cases with persistence mechanisms or secondary tools as active compromises requiring full containment, not isolated execution events, since blocking one C2 connection will not stop scheduled tasks from continuously re-attempting callback and maintaining attacker access.
- Source published
- First seen by Cybersecurity Tracker