New DNS Malware ‘Detour Dog’ Uses TXT Records to Deliver Strela Stealer
The Detour Dog malware campaign, active since August 2023, has advanced from redirecting users to tech-support scams to using a DNS-based command-and-control (C2) system. This system now delivers the Strela Stealer information stealer via DNS TXT records.
The Detour Dog malware campaign, active since August 2023, has advanced from redirecting users to tech-support scams to using a DNS-based command-and-control (C2) system. This system now delivers the Strela Stealer information stealer via DNS TXT records.
Compromised websites worldwide make server-side DNS requests that remain invisible to visitors, allowing for conditional redirections and remote code execution.
Initially, Detour Dog-controlled name servers redirected infected sites to scam sites like Los Pollos and Help TDS. In November 2024, these redirects shifted to include Monetizer TDS networks, maintaining fraudulent traffic monetization.
In spring 2025, Detour Dog began using DNS TXT queries to deliver commands, instructing compromised sites to execute PHP scripts from remote C2 servers. This represents the first direct malware delivery to home users by Detour Dog.
In June 2025, researchers observed Detour Dog infrastructure hosting the StarFish backdoor, which installs the Strela Stealer payload. Analysis showed that 69% of StarFish staging hosts were under Detour Dog control.
Externally, StarFish and Strela were distributed via spam sent through the REM Proxy MikroTik botnet and the Tofsee botnet. On June 8, DNS TXT responses began supplying C2 URLs for PHP endpoints, creating a multi-stage, DNS-orchestrated delivery chain.
This system now delivers the Strela Stealer information stealer via DNS TXT records.
Compromised sites generate DNS TXT queries in the format:
<infected-host>.<visitor-ip>.<rand>.<type>.c2_domain
When the <type> matches patterns like nwuuscript or nauufile , the name server returns a TXT record with a C2 URL. The PHP script output is relayed to the victim via server-side curl requests, evading client-side detection.
Passive DNS logs from August 6–8, 2025, show over 4 million queries, displaying a complex distribution model. Shadowserver Foundation sinkholed the primary C2 domain, webdmonitor[.]io , in August 2025, but Detour Dog quickly established aeroarrows[.]io . Data captured over 39 million TXT queries in 48 hours from 30,000 infected hosts across 584 TLDs.
Some encoded IPs belonged to U.S. Department of Defense subnets, indicating potential unidentified sources of these queries.
Historic Evolution and Affiliate Network Ties
Detour Dog’s origins date back to February 2020, initially forwarding traffic to Los Pollos affiliates and later integrating Help TDS affiliates. Detailed redirection chains documented in late 2024 illustrate transitions between affiliate networks with consistent tracking parameters.
This DNS TXT C2 model represents a novel malware distribution architecture, concealing the true C2 infrastructure behind a global network of compromised websites. By merging affiliate marketing traffic with DNS-based remote execution, Detour Dog obfuscates attack chains and misdirects defenders.
As Detour Dog continues to evolve, organizations and threat hunters must incorporate DNS TXT monitoring and sinkholing strategies to detect and mitigate such covert threats.
Based on reporting by GBHackers.