New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS

New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS

• Threat actors are now abusing DNS queries as part of ClickFix social engineering attacks to deliver malware, making this the first known use of DNS as a channel in these campaign

Cybersecurity · February 16, 2026 (updated February 24, 2026) · 2 min · 276 words