Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands

Cybersecuritynews • February 5, 2026

Share: View original

KongTuke attacks use ClickFix lures, tricking users into pasting malicious scripts via fake errors, bypassing enterprise security controls.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattackers Exploit ClickFix Script via DNS TXT Records for PowerShell Execution Cyberattackers have been exploiting DNS TXT records within the ClickFix script to execute malicious PowerShell commands. This tactic has been linked to the KongTuke campaign, which has been active since mid-2025 and employs social engineering to trick users into addressing fake website errors. Organizations using vulnerable systems are at risk of being compromised through this method. 14 sources 40

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

T1059.001 - PowerShell

Tools (2)

ClickFix Script PowerShell