Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The cybersecurity landscape has darkened with the sophisticated evolution of the KongTuke campaign. Active since mid-2025, this threat actor group has continuously refined its techniques to bypass conventional enterprise security filters. <\/p>\n
Their primary weapon remains the \u201cClickFix\u201d strategy, a social engineering vector that deceives unsuspecting users into manually fixing simulated website errors.<\/p>\n
In these attacks, victims encounter fake browser glitches or verification captchas on compromised legitimate websites. <\/p>\n
Deceptive instructions prompt them to copy a malicious script and paste it directly into the Windows Run dialog or a PowerShell terminal. <\/p>\n
This \u201cself-infection\u201d method effectively bypasses automated download protections by leveraging the user\u2019s own system privileges to execute unauthorized code.<\/p>\n
However, a significant escalation in technical tradecraft has recently surfaced.\u00a0Unit 42 analysts identified<\/a>\u00a0that the latest KongTuke iterations now employ DNS TXT records to stealthily mask their next stage. <\/p>\n Instead of reaching out to a flagged web server<\/a> via HTTP, the initial script queries a legitimate-looking domain\u2019s DNS records to retrieve malicious staging instructions from the record.<\/p>\n