ClickFix Evolves with PySoxy Proxying

A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• third-party.com Placeholder Domain Now Serves ClickFixCampaign2026-09-24
• How Attackers Redirect Crypto PaymentsMalware2026-10-29
• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28