Attackers Using DNS TXT Records in ClickFix Script to Execute Powershell Commands

The report describes the KongTuke campaign (active since mid-2025) that uses a "ClickFix" social-engineering lure to get users to run malicious scripts and now stages next-stage payloads via DNS TXT records to perform fileless PowerShell execution and deploy the Interlock RAT; defenders are advised to monitor DNS anomalies, block suspicious/new domains, and audit PowerShell execution logs.