ClickFix Evolves Using Decade-Old Open

Gbhackers •Mayura Kathir • May 13, 2026

A newly observed ClickFix campaign is pushing beyond simple user-triggered infections, introducing a more persistent and stealthy intrusion chain using PySoxy, a 10-year-old open-source Python SOCKS5 proxy. Unlike traditional ClickFix attacks that rely on a single PowerShell execution, this campaign builds a layered access model. A single user action typically executing a malicious PowerShell command […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickFix and PySoxy Proxying Threatens Cybersecurity with Enhanced Persistence Cybercriminals are leveraging ClickFix attacks in combination with the PySoxy proxy tool to maintain persistence on compromised systems. This tactic allows attackers to bypass traditional defenses and continue their operations even after initial access is blocked. The campaign, reported by ReliaQuest, indicates a shift from one-time exploits to modular post-exploitation strategies. Attackers use social engineering to trick victims into executing malicious commands, which then establish multiple command-and-control (C2) channels. The use of PySoxy enables encrypted proxy access, complicating detection and response efforts. This evolution in tactics poses significant challenges for cybersecurity teams, as it requires a more comprehensive approach to incident response. The Australian Cyber Security Centre recently issued warnings about widespread ClickFix campaigns targeting various organizations. Security professionals are advised to review scheduled tasks and analyze Python artifacts to mitigate these threats. 4 sources 69

Extracted Entities

ClickFix Evolves Using Decade-Old Open

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)