people · May 17, 2026
ReliaQuest Details ClickFix Evolution with PySoxy for Persistent Access
Share the canonical public link.
ReliaQuest published details on May 14, 2026 about ClickFix evolving to use PySoxy proxy for a second encrypted C2 path. The operator employed 5 Microsoft 365 tenants in 45 days along with redundant C2 and 4 separate persistence triggers in the attack chain. ReliaQuest Threat Research Team showed how blocking one path may still leave the attacker inside enterprise environments. Cyber_OSINT posted the ReliaQuest Threat Spotlight link on X with 10 likes and 4 reposts on May 14, 2026.
Spend governor blocked model creation: provider_circuit_open (lane=dev, provider=together)