Hiding in Plain Sight: Part 2

Analysts uncovered a multi-stage, multi-payload malware campaign that uses masqueraded Windows binaries and obfuscated PowerShell to fetch further payloads via DNS-over-HTTPS TXT records. The malware hides payloads inside a fake DKIM TXT response, uses nested Base64 and numeric-encoded IPs to resolve dynamic C2 servers, and employs scheduled tasks and decoy filenames to evade detection, with multiple observed variants and reusable infrastructure.