ClickFix Attacks Evolve with PySoxy Proxy for Persistent, Malware-Free Access
Attackers are combining ClickFix social engineering with the decade-old open-source PySoxy SOCKS5 proxy to maintain persistent access on victims' machines without malware, even after initial access is blocked.
Cybercriminals have escalated the ClickFix social engineering technique by pairing it with PySoxy, a 10-year-old open-source Python SOCKS5 proxy, to achieve persistent, malware-free access to compromised systems. The campaign, detailed by ReliaQuest researchers on May 12, demonstrates that ClickFix attacks are evolving from one-time user-execution tricks into modular post-exploitation frameworks that are significantly harder to detect and contain.
ClickFix is a social engineering tactic that tricks users into running malicious commands or downloading harmful payloads by presenting fake error messages or update prompts. It has become a widely used method for distributing malware and stealing credentials. However, the campaign analyzed by ReliaQuest stood out because blocking the initial ClickFix access did not stop the intrusion. The attackers had deployed PySoxy, which established local persistence through a scheduled task, allowing the proxy to restart automatically even after the initial foothold was removed.
The attackers did not deploy PySoxy immediately after the initial ClickFix compromise. Instead, they conducted careful reconnaissance, gathering information about the environment, identifying potential follow-on targets, and confirming that the host could communicate with attacker-controlled staging infrastructure. Only after this deliberate preparation was PySoxy introduced. "That sequence matters because it shows deliberate preparation for continued access, not just one-off reconnaissance," said Ivan Righi, senior cyber threat intelligence analyst at ReliaQuest.
Once the proxy successfully connected to the attackers' command-and-control server, the final payload was introduced. Researchers observed attempts to deliver payloads via PowerShell and Python scripts, as well as attempts to drop a Remote Access Trojan (RAT). While endpoint controls blocked these delivery channels, the persistence mechanism remained critical because it allowed repeated re-execution attempts. "For response teams, this means that ClickFix incidents that include persistence and secondary tooling should be treated as active compromise investigations, with host isolation, full artifact review, and validation that all access paths and staged components have been removed," Righi added.
To counter similar ClickFix attacks that may have bypassed detection, ReliaQuest recommends that security teams review scheduled tasks, analyze Python artifacts, and hunt for proxy-style Python command lines rather than treating a blocked C2 connection as containment. The use of PySoxy, a legitimate open-source tool, makes detection particularly challenging because it does not rely on traditional malware signatures.
The campaign highlights a broader trend of attackers leveraging living-off-the-land techniques and open-source tools to evade security controls. Earlier this month, the Australian Cyber Security Centre (ACSC) issued a warning about a widespread ClickFix campaign targeting infrastructure providers. As ClickFix attacks continue to evolve, organizations must adapt their detection and response strategies to account for modular, persistence-focused post-exploitation tactics.