Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands

Cybersecuritynews •Tushar Subhra Dutta • February 5, 2026

The cybersecurity landscape has darkened with the sophisticated evolution of the KongTuke campaign. Active since mid-2025, this threat actor group has continuously refined its techniques to bypass conventional enterprise security filters. Their primary weapon remains the “ClickFix” strategy, a social engineering vector that deceives unsuspecting users into manually fixing simulated website errors. In these attacks, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattackers Exploit ClickFix Script via DNS TXT Records for PowerShell Execution Cyberattackers have been exploiting DNS TXT records within the ClickFix script to execute malicious PowerShell commands. This tactic has been linked to the KongTuke campaign, which has been active since mid-2025 and employs social engineering to trick users into addressing fake website errors. Organizations using vulnerable systems are at risk of being compromised through this method. 15 sources 40

Extracted Entities

Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (2)

Tools (1)