Executive Summary
ReliaQuest has observed a significant evolution in the 'ClickFix' campaign tradecraft, where attackers are moving beyond simple one-time execution to establishing modular post-exploitation access. In a recent April 2026 incident, attackers utilized traditional ClickFix social engineering lures to execute PowerShell, which subsequently established scheduled task persistence and deployed PySoxy, a 10-year-old open-source Python SOCKS5 proxy.
This activity is particularly concerning because the attackers established redundant, encrypted access paths that persisted even after initial C2 connections were blocked. The intrusion chain closely mirrors tradecraft associated with SocGholish, involving domain reconnaissance, persistence via scheduled tasks, and the use of legitimate interpreters to bypass traditional signature-based detections. The transition toward utilizing 'bring-your-own-interpreter' (BYOI) tools like PySoxy suggests that ClickFix is becoming a viable initial access source for high-impact follow-on activity, including potential ransomware deployment.