Threat actors are abusing DNS queries in a new ClickFix social engineering campaign to deliver malware, which makes it the first known use of DNS as a payload delivery channel in these attacks.
ClickFix campaigns typically trick users into manually running malicious commands under the pretense of fixing errors, installing updates, or enabling features. In this new variant, attackers use a novel technique where a malicious DNS server delivers the second-stage payload through DNS lookups.
Microsoft observed victims being instructed to run an nslookup command that queries an attacker-controlled DNS server instead of the default system resolver. The DNS response includes a malicious PowerShell script, which is then executed on the victim’s device to install malware.
According to Microsoft Threat Intelligence, attackers ask targets to run the command via the Windows Run dialog, triggering a DNS query for a specific hostname against the attacker’s server. The response contains a NAME field with embedded PowerShell code that executes through the Windows command interpreter.
The retrieved PowerShell payload downloads additional malware from attacker infrastructure, including a ZIP archive with a Python runtime and reconnaissance scripts. The malware establishes persistence by creating startup scripts and shortcuts, ultimately deploying the ModeloRAT remote access trojan to remotely control compromised systems.
Unlike traditional ClickFix attacks that use HTTP to retrieve payloads, this technique leverages DNS as both a staging and communication channel. Using DNS traffic helps attackers blend into normal network activity and dynamically change payloads.
ClickFix attacks have evolved rapidly, with attackers experimenting with new delivery methods and targeting multiple platforms. Recent campaigns have abused OAuth apps, AI-generated guides, and even browser-based JavaScript execution to hijack accounts and transactions, highlighting the growing sophistication of this social engineering technique.malwar
Comments