ReliaQuest Details ClickFix Intrusion Using PySoxy for Backup Access
Summary
ReliaQuest investigated an April 2026 ClickFix intrusion that paired scheduled-task persistence and PowerShell C2 with PySoxy proxying. Endpoint controls blocked both channels, but the task kept trying to restart the activity.
Key points
- ReliaQuest described an observed intrusion beginning with a user executing PowerShell after visiting a compromised website.
- A scheduled task relaunched a staged PowerShell script roughly every 40 minutes; the script polled for commands about every three seconds.
- The attacker used built-in Windows tools for account, domain-controller, host, and network-share reconnaissance.
- After staging activity and confirming connectivity, the attacker ran PySoxy from a Python bytecode file in C:\\ProgramData to establish a separate encrypted proxy path.
- Endpoint controls blocked both observed C2 channels, but the scheduled task continued attempting to restart the activity.
- ReliaQuest recommends isolating affected hosts and reviewing scheduled tasks, staged scripts, Python artifacts, and proxy-style command lines rather than treating a blocked callback as containment.
Article Details
- Attack Vectors
- A user was prompted by a compromised website to run an obfuscated PowerShell command, initiating the ClickFix intrusion.
- A scheduled task repeatedly relaunched a staged PowerShell script from C:\ProgramData, approximately every 40 minutes.
- The PowerShell script polled attacker infrastructure for commands every three seconds and returned command output.
- The attackers used built-in Windows commands, LDAP enumeration, and SMB activity for domain and host discovery.
- After staging and uploading a local log, the attackers downloaded a Python bytecode file and ran PySoxy with proxy-style arguments to establish an encrypted access path.
- Defensive Notes
- Isolate affected hosts even when outbound C2 connections have been blocked; inspect and remove scheduled tasks, staged scripts, Python artifacts, and proxy tooling.
- Correlate user-driven PowerShell execution with scheduled-task creation, writes to ProgramData, curl downloads, Python execution, and outbound connections.
- Hunt for .pyc execution and Python command lines containing arguments such as -ssl, -remote_ip, and -remote_port.
- Review domain reconnaissance activity, including group-membership checks, domain-controller enumeration, LDAP machine enumeration, and suspicious SMB activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | abledom[.]net | Identified as a secondary C2 domain. |
| DOMAIN | overlateise[.]com | Identified as hosting the ClickFix script injected into the compromised site. |
| DOMAIN | strapness[.]com | Identified as a ClickFix stager domain. |
| IPV4 | 167[.]99[.]158[.]97 | Destination IP supplied to PySoxy for its proxy connection. |
| IPV4 | 185[.]205[.]211[.]217 | Identified in the article's IOC table as ClickFix infrastructure. |
| IPV4 | 206[.]206[.]103[.]106 | Staging and exfiltration address used to upload a local log and download the PySoxy bytecode file. |
| IPV4 | 206[.]206[.]103[.]120 | Identified as the PowerShell RAT C2 address. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe attackers enumerated domain controllers with nltest.exe /dclist: and used LDAP-based machine enumeration to identify hosts.T1027 · Obfuscated Files or InformationThe initial PowerShell command was obfuscated by referencing commands indirectly to make its behavior less obvious.T1053.005 · Scheduled TaskA scheduled task relaunched the staged PowerShell script approximately every 40 minutes, including after outbound connections were blocked.T1059.001 · PowerShellAn obfuscated PowerShell command initiated execution; a staged PowerShell script then polled C2, ran received commands, and returned their output.T1059.003 · Windows Command ShellThe attackers used Windows command-line utilities, including nltest.exe /dclist:, during environment discovery.T1071.001 · Web ProtocolsThe PowerShell C2 polled an HTTP endpoint for tasks and posted command results; the article also describes web-style C2 traffic.T1087.002 · Domain AccountThe attackers checked group memberships to assess the compromised account's privileges in the domain.T1090.001 · Internal ProxyPySoxy was used to route encrypted traffic through the compromised host as a proxy.T1105 · Ingress Tool TransferThe attackers downloaded the staged PySoxy bytecode file from their staging server to C:\ProgramData.T1135 · Network Share DiscoverySMB activity against discovered systems was observed during environment mapping.