ClickFix Evolves Using Decade-Old Open-Source Python SOCKS5 Proxy

ReliaQuest observed a ClickFix campaign that moves beyond single-step user-triggered infections by installing a scheduled-task persistent PowerShell stager that runs an in-memory RAT for reconnaissance and command execution, then deploying PySoxy (a Python SOCKS5 proxy) to create an encrypted secondary C2 over port 443. The report includes observed command lines, persistence details, reconnaissance actions, IOCs (IPs and domains), and detection/containment recommendations emphasizing system isolation and scheduled-task and ProgramData artifact reviews.