--- title: "ClickFix finds a backup plan in PySoxy proxy chains" url: https://daily.dev/posts/clickfix-finds-a-backup-plan-in-pysoxy-proxy-chains-p8vxk8gy5 source_url: https://www.csoonline.com/article/4170747/clickfix-finds-a-backup-plan-in-pysoxy-proxy-chains.html type: article source: "CSO Online" published: 2026-05-13T11:47:17.196Z updated: 2026-05-13T11:47:46.409Z tags: ["security", "malware", "powershell"] reading_time: 3 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ClickFix finds a backup plan in PySoxy proxy chains **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments ## Summary ReliaQuest researchers observed a new ClickFix attack chain that pairs the social engineering technique with PySoxy, a decade-old open-source Python proxy tool, to establish redundant encrypted C2 access paths. The attack begins with a ClickFix lure tricking victims into executing a malicious command, which then sets up persistence via scheduled tasks, performs domain reconnaissance, opens a PowerShell-based C2 channel, and deploys PySoxy as a second encrypted communication path. This dual-channel approach ensures the intrusion continues even if the primary PowerShell C2 is blocked. Defenders are advised to hunt for scheduled task anomalies, unusual Python artifacts, and proxy-style command-line flags like -ssl, -remote_ip, and SOCKS. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments - [ClickFix Attacks Abuses DNS Lookup Command to Deliver ModeloRAT](https://daily.dev/posts/clickfix-attacks-abuses-dns-lookup-command-to-deliver-modelorat-kjxanvy1v) · Dark Reading · 0 upvotes · 0 comments - [Now, even Russia’s most elite hackers are using Clickfix to infect devices](https://daily.dev/posts/now-even-russia-s-most-elite-hackers-are-using-clickfix-to-infect-devices-ifkhhbbii) · Ars Technica · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/clickfix-finds-a-backup-plan-in-pysoxy-proxy-chains-p8vxk8gy5)