New Clickfix Attack Uses DNS Hijacking to Spread Malware
Recent developments in the ClickFix social engineering campaign have introduced a custom DNS hijacking technique to deliver malware.
Recent developments in the ClickFix social engineering campaign have introduced a custom DNS hijacking technique to deliver malware.
The attack involves inducing users to execute malicious commands via DNS lookups. This approach enables attackers to bypass conventional detection systems and integrate seamlessly with standard network traffic.
ClickFix attacks utilize deceptive techniques, presenting users with fake error messages, such as counterfeit CAPTCHA prompts or "fix this issue" notifications on compromised sites.
The strategy persuades victims to copy a script into their clipboard and execute it through system dialogs like the Run command or PowerShell. Unlike previous variants that relied on fake browser crashes, this iteration employs a more sophisticated approach involving the Domain Name System.
Upon execution, the script uses cmd.exe to initiate a specific DNS lookup against an attacker-controlled server, bypassing the default internet resolver.
Recent developments in the ClickFix social engineering campaign have introduced a custom DNS hijacking technique to deliver malware.
The script analyzes the DNS response, extracting the Name: field, which contains the second-stage payload code, subsequently executed on the victim's system.
This method transforms DNS into a lightweight staging channel, allowing attackers to confirm target activity before deploying heavier malware components.
Using DNS traffic, which is prevalent across networks, facilitates command and control without triggering alerts.
Microsoft Defender researchers have noted that the DNS response triggers the attack chain to download a ZIP file with a portable Python bundle. The infection process proceeds by executing a malicious Python script for host and domain reconnaissance.
The malware achieves persistence by deploying a VBScript file and creating a shortcut named MonitoringService.lnk in the Windows Startup folder.
The campaign's final payload is a Remote Access Trojan (RAT) identified as ModeloRAT, detected by Microsoft Defender Antivirus under the threat signature Trojan:Win32/ClickFix.R!ml.
Based on reporting by Cyber Security News.