ClickFix Campaigns Adopt DNS TXT and Cache Pre-fetching to Evade Detection

Threat actors operating the ClickFix campaign have evolved their tactics to better conceal malicious payloads, according to a report by Dark Reading. The attackers are now leveraging DNS TXT records and browser cache pre-fetching techniques, which obscure the early stages of the intrusion and complicate detection efforts for security teams.

The shift in methodology marks a significant change in how the ClickFix group delivers its malware. By embedding data within DNS TXT records, the attackers can retrieve malicious code or configuration details without triggering alerts that might occur with standard HTTP requests or file downloads. This method allows the payload to remain hidden within routine network traffic, making it difficult for perimeter defenses to distinguish between legitimate DNS queries and malicious data retrieval.

Evasion Techniques and Detection Challenges

The use of browser cache pre-fetching further complicates the security landscape. This technique involves loading resources into the browser cache before they are explicitly requested by the user or the application. By pre-fetching malicious components, the attackers can ensure that the payload is ready for execution while masking the initial fetch as a standard browser optimization behavior.

According to Dark Reading, these combined techniques make it tougher to spot the early attack stages. Traditional security tools that rely on inspecting direct connections or obvious file downloads may miss these subtle indicators. The reliance on standard protocols like DNS and common browser behaviors allows the ClickFix actors to blend in with normal network activity, reducing the likelihood of immediate flagging by automated security systems.

Impact on Security Operations

The evolution of the ClickFix campaign poses a direct challenge to security operations centers and threat hunting teams. The ability to hide payloads in DNS TXT records means that analysts must expand their monitoring scope to include deeper inspection of DNS traffic. Standard firewall rules that allow outbound DNS traffic may inadvertently facilitate the delivery of the malicious payload.

Furthermore, the use of cache pre-fetching requires a more nuanced approach to endpoint detection. Security teams must look beyond simple process execution and examine the context of resource loading. The report from Dark Reading highlights that these methods are specifically designed to evade detection, suggesting that the ClickFix group is actively adapting to improve its operational security and persistence.

What should you do?

Security professionals should review their DNS logging and monitoring capabilities to ensure that TXT record queries are being captured and analyzed. Additionally, organizations should assess their browser security policies to understand how pre-fetching is handled and whether it can be restricted for high-risk environments.

What to do and how to stay safe: ClickFix

• Monitor DNS TXT record queries for anomalies, such as unusually large responses or queries to suspicious domains.
• Review browser pre-fetching settings and consider restricting pre-fetching for sensitive applications or networks.
• Implement deep packet inspection for DNS traffic to detect hidden payloads in TXT records.
• Update threat intelligence feeds to include indicators of compromise related to the ClickFix campaign’s new tactics.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What new techniques are ClickFix attackers using?

They are using DNS TXT records and browser cache pre-fetching to hide malicious payloads.

Why are these techniques effective?

They make it tougher to spot early attack stages by blending with normal network and browser behavior.

Who reported this evolution in tactics?

The evolution was reported by Dark Reading.