New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS

**ClickFix campaign abusing DNS for payload delivery:** Microsoft observed ClickFix social-engineering attacks that instruct victims to run an nslookup query against an attacker-controlled DNS server which returns a PowerShell payload in the DNS response; that payload downloads a ZIP containing a Python runtime and scripts, establishes persistence (VBScript and Startup shortcut), and deploys ModeloRAT to enable remote control of infected systems.