Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging

Folks, pay attention to this one. Microsoft has dropped details on a new ClickFix social engineering tactic that leverages standard DNS lookups for malware staging.

This evolution of the ClickFix attack chain tricks users into executing commands, specifically the nslookup utility on Windows, to perform custom DNS queries. The purpose of these queries is to retrieve the next-stage payload, effectively using DNS as a command-and-control channel for initial delivery.

Technical Breakdown:

• TTPs:
  • Social Engineering (TA0001): Attackers entice users to manually run commands.
  • Execution (TA0002): Utilizes nslookup (T1059.006 - Command and Scripting Interpreter: PowerShell, cmd; though nslookup itself is a network utility, its execution in this context falls under general command execution) to perform custom DNS lookups.
  • Command and Control (TA0011): DNS (T1071.004 - Application Layer Protocol: DNS) is used to retrieve the next-stage malicious payload, indicating an innovative use of a common protocol for staging.
• Affected Systems: Windows operating systems where nslookup is available.
• IOCs: No specific IP addresses, domains, or hashes were disclosed in the provided summary.

Defense: Educate users thoroughly on the risks of running unsolicited commands, regardless of their perceived innocuousness. Monitor DNS query logs for unusual or high-volume nslookup activity and suspicious domain resolutions originating from endpoints. Implementing robust Endpoint Detection and Response (EDR) solutions can help detect and block such command executions.

Source: https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html