A simple copy-and-paste script is no longer just a one-time warning it is the gateway to a relentless, multi-layered network invasion.
In a recently observed April 2026 intrusion, threat actors deployed a dangerous new combination: pairing the notorious ClickFix social engineering scheme with PySoxy, a decade-old open-source SOCKS5 proxy tool.
This evolution transforms a single user mistake into a durable, redundant access chain that stubbornly survives standard defensive blocks.
Traditionally, ClickFix attacks rely on tricking users into pasting malicious PowerShell commands to deliver a quick payload. However, security researchers at ReliaQuest discovered that attackers are now using this initial foothold to establish deep persistence.
Instead of stopping at a single execution, the malicious script creates a scheduled task that repeatedly relaunches an in-memory PowerShell remote-access trojan (RAT).
This lightweight RAT checks in with command-and-control (C2) servers every 3 seconds, allowing hackers to maintain access and map the target’s domain without dropping traditional malware.
ClickFix Abuses Python Proxy
Once the attackers secured their PowerShell foothold, they quietly scanned the victim’s environment.
They used built-in Windows tools to identify group privileges, enumerate domain controllers, and find secondary targets.
After confirming their staging infrastructure was reachable, the hackers escalated the attack by dropping PySoxy into the system’s local data folders.
Running compiled Python bytecode from non-standard directories, PySoxy created a second, entirely separate encrypted access path over port 443.
This dual-layered strategy gave the attackers a massive advantage. By combining the automated PowerShell RAT with a Python-based proxy, they ensured that if a security team blocked one connection, the other would seamlessly take over.
The scheduled task served as the anchor, relaunching the malicious scripts every 40 minutes so the attack continuously resurrected itself.
According to ReliaQuest research, the primary lesson for defenders is that simply blocking an outbound C2 connection does not equal containment. In this incident, endpoint controls successfully blocked both the PowerShell and PySoxy traffic.
However, the local scheduled task kept the intrusion alive for hours. Responding to modern ClickFix incidents requires treating them as full-scale compromise investigations.
Security teams must isolate affected hosts, deactivate compromised accounts, and scrub all persistence mechanisms, including hidden Python runtimes and scheduled tasks.
Indicators of Compromise
| Indicator | Type | Details |
|---|---|---|
| 185.205.211[.]217 | IP Address | ClickFix Infrastructure IP |
| 206.206.103[.]120 | IP Address | PowerShell RAT C2 |
| 206.206.103[.]106 | IP Address | Staging and Exfiltration IP |
| 167.99.158[.]97 | IP Address | PySoxy Proxy Destination IP |
| strapness[.]com | Domain | ClickFix Stager Domain |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
