ClickFix Attacks Evolve to Better Hide Malicious Payloads
ClickFix operators now hide payloads in DNS TXT records and browser cache prefetching to evade early detection.
Dark Reading reports that ClickFix attacks are evolving so operators can better conceal malicious payloads. Threat actors are hiding payload content in DNS TXT records and using browser cache prefetching. The techniques are intended to make the earliest stages of the attack harder to spot. The report describes current use by threat actors rather than a single named victim or malware family.
- ClickFix operators are changing how they conceal malicious payloads.
- Payloads are being hidden in DNS TXT records.
- Browser cache prefetching is also used to obscure early stages.
- The changes make initial attack activity harder to detect.
From the original article
Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.