DNS TXT Records Used to Hide PowerShell Payloads in ClickFix Campaigns

Du'aine Davis

Observed in the wild

• Since mid‑2025, the KongTuke threat group has escalated its ClickFix social‑engineering attacks, recently identified on 4–5 February. Victims encounter fake browser errors or CAPTCHAs on compromised legitimate sites, leading them to paste attacker‑supplied commands into Windows Run/PowerShell, resulting in self‑infection and eventual delivery of RATs such as Interlock.
• KongTuke now embeds its next‑stage payloads inside DNS TXT records rather than HTTP endpoints. The initial ClickFix script triggers PowerShell to perform DNS TXT lookups (often via Google’s 8.8.8.8) and executes the returned text in‑memory, bypassing URL filtering and reducing disk artefacts. Traffic appears as routine DNS queries, complicating detection.
• Organisations are advised to monitor and alert on unusual PowerShell DNS‑query behaviour, inspect DNS TXT traffic for anomalies, block newly registered or suspicious domains, and maintain strict Microsoft Defender controls by monitoring execution‑policy changes, unexpected disabling attempts, and in‑memory PowerShell activity.

Unit 42 on X: "We discovered the #KongTuke campaign using #DNS TXT records in its #ClickFix script. These DNS TXT records staged a command to retrieve and run a PowerShell script. We continue to monitor ClickFix campaigns for any future occurrences. Details at https://t.co/nU4KHPPlk5 https://t.co/JGIMcpyrlk" / X