ALL POSTS

Key Findings Microsoft warns of a new ClickFix variant that tricks users into running a malicious nslookup command through the Windows Run dialog to retrieve a second-stage payload via DNS. Attackers use cmd.exe to perform a DNS lookup against a hard-coded external server, and the `Name:` response is extracted and executed as the second-stage payload. This DNS-based approach allows attackers to signal and deliver payloads via their own infrastructure, reducing reliance on web

Key Findings Microsoft has disclosed details of a new version of the ClickFix social engineering tactic that uses DNS lookups to retrieve malware payloads. The attack tricks users into running commands through the Windows Run dialog that perform a DNS lookup to an external server controlled by the attackers. The DNS response is then executed as the second-stage payload, allowing the threat actors to reach infrastructure under their control and establish a new validation layer

Key Findings The Kimwolf Android botnet has infected over 1.8 million devices globally, primarily targeting TV boxes It uses advanced techniques like DNS over TLS, elliptic curve digital signatures, and blockchain domains to evade detection The botnet is capable of massive DDoS attacks, issuing over 1.7 billion commands in a three-day period Kimwolf shares code with the Aisuru botnet family but has been heavily redesigned to avoid detection Background The Kimwolf botnet was f