OTX-6a04a9a171b2ad5ef57d9993 info

Description

A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks. Pulse contains 3 indicator(s) (IOCs). View on OTX to inspect.

Indicators of Compromise (6)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• OTX pulse AlienVaulkt OTX

  A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a

• reference AlienVaulkt OTX

• Attackers Combine ClickFix With PySoxy Proxying to Maintain Persistence
  web:bladeintel.com

  Cybercriminals have combined ClickFix attacks with PySoxy , a 10-year-old open-source Python SOCKS5 proxy, to maintain persistence on victims' machines without malware, even after attempts at removal.

  2026-05-17 00:54 UTC
• Hackers Upgrade ClickFix Attacks Using Decade-Old Python SOCKS5 Proxy Tool
  web:cyberpress.org

  A simple copy-and-paste script is no longer just a one-time warning it is the gateway to a relentless, multi-layered network invasion. In a recently observed April 2026 intrusion, threat actors deployed a dangerous new combination: pairing the notorious ClickFix social engineering scheme with PySoxy , a decade-old open-source SOCKS5 proxy tool. This evolution transforms a single user mistake ...

  2026-05-17 00:54 UTC
• ClickFix Evolves with PySoxy Proxying - reliaquest.com
  web:reliaquest.com

  ClickFix just got more dangerous. Discover how one pasted command creates persistent, redundant access—and how to detect it before the damage spreads.

  2026-05-17 00:54 UTC
• ClickFix Uses PySoxy for Encrypted Proxy Access
  web:socprime.com

  ClickFix now chains PowerShell persistence with PySoxy to create encrypted proxy access and harder-to-detect post-compromise control

  2026-05-17 00:54 UTC
• ClickFix Attacks Add PySoxy Proxy to Maintain Access After Initial ...
  web:vpncentral.com

  A ClickFix attack chain observed by ReliaQuest shows how the social engineering technique is evolving from a one-time user mistake into a more durable intrusion method. In this case, attackers combined malicious PowerShell execution with PySoxy , an open-source Python SOCKS5 proxy tool, to create a second route back into a compromised Windows host. The attack […]

  2026-05-17 00:54 UTC
• ClickFix finds a backup plan in PySoxy proxy chains
  web:www.csoonline.com

  ReliaQuest observed attackers pairing ClickFix with the PySoxy proxy tool to establish redundant encrypted access paths and persistence on compromised systems.

  2026-05-17 00:54 UTC
• ClickFix Campaign Evolves with PySoxy SOCKS5 Proxy
  web:www.cybermaterial.com

  Threat actors have evolved the ClickFix social engineering technique by incorporating PySoxy , a decade-old open-source Python SOCKS5 proxy tool, to establish persistent and covert access to victim networks.

  2026-05-17 00:54 UTC
• Attackers Combine ClickFix With PySoxy to Maintain Persistence
  web:www.infosecurity-magazine.com

  Cybercriminals have combined ClickFix attacks with PySoxy , a 10-year-old open-source Python SOCKS5 proxy, to maintain persistence on victims' machines without malware, even after attempts at removal. The campaign has been detailed by cybersecurity researchers at ReliaQuest, who warned that it shows that ClickFix attacks are moving beyond one-time user execution into modular post-exploitation ...

  2026-05-17 00:54 UTC

Only Available for Registered Users. Sign in to view.