Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging

Microsoft and multiple security vendors have documented an evolution of ClickFix social‑engineering attacks that now use DNS (nslookup) as a lightweight staging channel to retrieve and execute second‑stage payloads. These chains lead to the download and execution of malware families including ModeloRAT and several infostealers (Lumma, Odyssey, MacSync), delivered via loaders such as CastleLoader and RenEngine and leveraging fake CAPTCHAs, malvertising, compromised/ad‑served pages, and phishing lures across Windows and macOS; campaigns employ persistence (LNK in Startup, LaunchDaemons), evasive checks, and aged/compromised domains for C2, resulting in credential and cryptocurrency theft at international scale.