Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands
The KongTuke campaign has introduced advanced techniques in its operations, complicating detection efforts within the cybersecurity domain. Since mid-2025, this threat actor group has utilized the "ClickFix" strategy, effectively circumventing standard…
The KongTuke campaign has introduced advanced techniques in its operations, complicating detection efforts within the cybersecurity domain. Since mid-2025, this threat actor group has utilized the "ClickFix" strategy, effectively circumventing standard enterprise security measures.
The "ClickFix" approach involves social engineering tactics where users are deceived into fixing purported website errors. These attacks often present fake browser issues or verification captchas on compromised legitimate sites, guiding victims to paste malicious scripts into the Windows Run dialog or PowerShell terminal. This method, known as "self-infection," exploits system privileges to execute unauthorized code.
Recent developments have seen the incorporation of DNS TXT records by the KongTuke campaign. This advancement was identified by Unit 42 analysts, who noted that the latest iterations utilize DNS records to stealthily retrieve subsequent stages of the attack. Instead of accessing a suspicious web server via HTTP, the initial script queries a domain's DNS records to obtain malicious instructions.
The KongTuke campaign has introduced advanced techniques in its operations, complicating detection efforts within the cybersecurity domain.
The use of DNS TXT records allows attackers to embed payloads within DNS responses, masking malicious traffic within legitimate internet resolution activities. This approach complicates detection efforts relying on standard HTTP analysis, as the payload retrieval mechanism involves executing a PowerShell command that performs a DNS lookup for specific TXT records. These records contain the command string necessary to fetch and execute the final payload.
Security measures often permit unrestricted DNS traffic to ensure connectivity, creating potential blind spots for detection. The KongTuke campaign utilizes a "fileless" retrieval method, parsing DNS response text and executing it in memory, leaving minimal traces on the disk. This technique allows the campaign to maintain a low profile while establishing persistence on compromised endpoints.
Block newly registered domains. Validate DNS traffic for anomalies. Monitor PowerShell execution logs for suspicious DNS lookup commands.
Based on reporting by Cyber Security News.