ClickFix Evolves with 10-Year-Old Open-Source Python SOCKS5 Proxy

A ClickFix campaign is described where attackers use a fake prompt to get users to paste-and-run PowerShell, then deploy a scheduled task and a staged script in C:\ProgramData to maintain persistence and reconnaissance; they also introduce PySoxy (a Python SOCKS5 proxy) as a second independent access channel. The report warns that blocking a single outbound connection is insufficient, recommends full host isolation, removal of staged scripts/Python bytecode, and hunting for scheduled tasks and proxy-style Python execution, and provides IP and domain IOCs.