DNS TXT Records Exploited In ClickFix Script For Remote PowerShell Command Execution

Cyberpress • February 5, 2026

Share: View original

Cyber threats evolve fast, and attackers now hide commands in plain sight using everyday DNS features. A new campaign called KongTuke has.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattackers Exploit ClickFix Script via DNS TXT Records for PowerShell Execution Cyberattackers have been exploiting DNS TXT records within the ClickFix script to execute malicious PowerShell commands. This tactic has been linked to the KongTuke campaign, which has been active since mid-2025 and employs social engineering to trick users into addressing fake website errors. Organizations using vulnerable systems are at risk of being compromised through this method. 15 sources 40

Extracted Entities

APT Groups (1)

MITRE ATT&CK (2)

T1059.001 - PowerShell T1071.004 - DNS

Tools (1)

ClickFix Script