ClickFix Attacks Abuses DNS Lookup Command to Deliver ModeloRAT

ClickFix attacks have evolved to abuse nslookup/DNS lookups as a new evasion technique to smuggle instructions and download a ZIP that drops a Python-based RAT (ModeloRAT), with attackers relying on fake CAPTCHA and social engineering to get victims to paste commands that self-infect their devices. Microsoft and Malwarebytes observed this shift away from blocked PowerShell/mshta techniques; the report details the delivery chain, enterprise impact potential, and advises users to avoid running commands from untrusted sources, verify instructions, and refrain from copy-pasting commands.