Microsoft alerts on DNS-based ClickFix variant delivering malware via nslookup

Microsoft warns of a ClickFix variant that social-engineers victims into executing a malicious nslookup via the Windows Run dialog to retrieve a second-stage payload over DNS, which downloads a ZIP containing a portable Python bundle and malicious scripts and ultimately installs ModeloRAT with persistence via a Startup shortcut. The campaign uses DNS-based staging to reduce reliance on web requests and evade detection while performing reconnaissance and discovery on compromised hosts.