ClickFix added nslookup commands to its arsenal for downloading RATs

The report describes ongoing ClickFix campaigns that trick users into executing malicious copy‑paste commands, now abusing nslookup to fetch a ZIP that extracts a Python script, stages a VBScript, and ultimately deploys ModeloRAT for remote control of Windows systems. It outlines the social-engineering lures (fake CAPTCHAs, updates, browser crashes, tutorial videos), the evasion of blocked mshta/PowerShell via nslookup-based payload delivery, and provides high-level defense guidance (avoid untrusted commands, slow down, minimize copy-paste, use real-time protection, and stay informed).