Signal
ClickFix abuses dns/nslookup to help deliver rats
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-02-16 11:56 UTCUpdated 2026-02-16 13:09 UTC
rss
malwaresocial_engineeringdns_abuseratthreat_activity
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Microsoft-linked warning coverage and Malwarebytes analysis describe ClickFix campaigns abusing DNS lookups—specifically using the built-in nslookup tool—as part of a technique to deliver RAT payloads.
Entities
MicrosoftSecurityWeekClickFixModeloRATnslookup
Score total
1
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- Fresh reporting highlights ClickFix adding nslookup/DNS lookups to its tradecraft
- Multiple outlets align on DNS lookup abuse being used in RAT delivery activity
Why it matters
- Built-in DNS tooling (nslookup) can be repurposed in malware delivery chains
- ClickFix’s user-executed-command model keeps social engineering central to compromise
- DNS responses carrying crafted data broaden what defenders may need to monitor
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- ClickFix campaigns are using DNS lookups (including nslookup) as part of the delivery chain for RAT payloads.
- The campaigns emphasize tricking victims into executing malicious commands themselves (e.g., via fake CAPTCHA-style instructions).
How sources frame it
- SecurityWeek: neutral
- Malwarebytes Threat Analysis: neutral
Two-source cluster; both items describe the same ClickFix technique shift toward DNS/nslookup-assisted RAT delivery.
All evidence
All evidence
ClickFix added nslookup commands to its arsenal for downloading RATs
Malwarebytes Threat Analysis · malwarebytes.com · 2026-02-16 13:09 UTC
Microsoft Warns of ClickFix Attack Abusing DNS Lookups
SecurityWeek · securityweek.com · 2026-02-16 11:56 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- Malwarebytes Threat Analysis (1)
- SecurityWeek (1)
Top origin domains (this list)
- malwarebytes.com (1)
- securityweek.com (1)