Hackers Upgrade ClickFix Attacks Using Decade-Old Python SOCKS5 Proxy Tool

ReliaQuest observed an April 2026 intrusion where threat actors used a ClickFix paste-based social-engineering technique to execute a PowerShell RAT that creates a scheduled task for persistence, while also deploying PySoxy (a Python SOCKS5 proxy) to establish a secondary encrypted access path over port 443; defenders must treat such incidents as full compromises, isolate hosts, remove persistence (scheduled tasks and hidden Python runtimes), and investigate provided IoCs.