ClickFix Evolution — nslookup DNS Smuggling + CrashFix Browser DoS + ModeloRAT Python RAT, KongTuke Actor, Enterprise Domain-Joined Targeting
ClickFix Evolution (TL-2026-0118) is a high-severity phishing campaign, first published 2026-02-16. It is attributed to KongTuke with medium confidence, maps to 33 MITRE ATT&CK techniques (T1016, T1027, T1036.005), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0118
- Threat ID
- TL-2026-0118
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-02-16
- Last reviewed
- 2026-02-16
- Attribution
- KongTuke
- Attribution confidence
- MEDIUM
- Motivation
- financial
- Target sectors
- enterprise, technology, corporate
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in ClickFix Evolution
Malware and tooling: CrashFix, ModeloRAT, nslookup
ClickFix social engineering campaigns have evolved with two major developments in early 2026: (1) nslookup DNS smuggling — abusing the built-in Windows DNS lookup tool to smuggle encoded payloads via DNS TXT records, bypassing mshta/PowerShell blocks, and (2) CrashFix — a malicious Chrome extension ('NexShield') that deliberately crashes the browser then baits users into running ClickFix commands to 'fix' it. Both chains deliver ModeloRAT, a previously undocumented Python-based RAT targeting domain-joined corporate hosts. Campaign attributed to KongTuke threat actor tracked since early 2025.
How ClickFix Evolution works
ClickFix is a social engineering attack paradigm where victims are tricked into infecting their own machines by copying and pasting malicious commands. The technique has been evolving rapidly since 2024, and in early 2026 two significant new variants emerged:
**EVOLUTION 1 — NSLOOKUP DNS SMUGGLING (February 2026):** Microsoft Security Intelligence documented ClickFix campaigns now using nslookup, the built-in Windows DNS resolution tool, to smuggle malware payloads. The innovation: mshta.exe and PowerShell are increasingly blocked by EDR/AV solutions, so attackers pivoted to nslookup — a trusted, ubiquitous LOLBIN that is rarely monitored or blocked.
The attack chain: 1. Victim encounters fake CAPTCHA, browser crash, or update prompt 2. Social engineering instructs victim to copy-paste a command into Windows Run dialog 3. Command executes nslookup queries against attacker-controlled DNS server 4. DNS TXT records return encoded payloads/commands instead of normal DNS data 5. Downloaded ZIP archive contains malicious Python scripts 6. Scripts perform reconnaissance and discovery 7. VBS dropper deploys ModeloRAT (Python-based RAT)
Why nslookup works: It's signed by Microsoft, present on every Windows installation, typically whitelisted by EDR solutions, and its network traffic (DNS queries) blends with normal operations. Security teams rarely monitor nslookup execution or DNS TXT record content.
**EVOLUTION 2 — CRASHFIX BROWSER EXTENSION (January 2026):** Huntress documented a new ClickFix variant dubbed 'CrashFix' deployed by the KongTuke threat actor. The attack uses a malicious Chrome extension called 'NexShield' that impersonates the legitimate uBlock Origin Lite ad blocker. The extension was distributed through the official Chrome Web Store, lending false legitimacy.
The CrashFix attack chain: 1. Victim searches for ad blocker, encounters malicious Google ad 2. Ad directs to Chrome Web Store listing for 'NexShield – Advanced Web Protection' 3. Extension is a near-exact clone of uBlock Origin Lite with 3,276 bytes of added malicious code 4. After 60-minute delay (Chrome Alarms API), extension triggers browser DoS 5. DoS loop creates billions of chrome.runtime port connections, exhausting resources 6. Browser becomes unresponsive and crashes 7. On restart, fake 'CrashFix' security warning appears 8. User is instructed to open Win+R, paste clipboard, press Enter to 'fix' the issue 9. Clipboard contains malicious command using finger.exe (LOLBIN) to fetch payload from C2 10. Payload chain: finger.exe → ROT-encoded PowerShell → script.ps1 → anti-analysis checks → domain-join check → ModeloRAT (domain-joined) or test payload (standalone)
**MODELORAT — NEW PYTHON RAT:** ModeloRAT is a previously undocumented Python-based Remote Access Trojan reserved exclusively for domain-joined (corporate) hosts. Key capabilities: - RC4 encrypted C2 communications over HTTP port 80 - Adaptive beaconing: 5min normal → 150ms active → 15min backoff - System reconnaissance: OS version, processes, services, storage, ARP, network, privileges, TCP connections - Persistence via HKCU\...\Run registry key with mimicked legitimate software names (e.g., 'Spotify47', 'Adobe2841') - Payload execution: EXE, DLL, and Python script support - Bundled WinPython for Python-independent execution - Anti-analysis: verbose/misleading class names, string concatenation for IOCs, junk code padding, hidden window execution - C2 servers: 170.168.103[.]208 and 158.247.252[.]178
**KONGTUKE THREAT ACTOR:** KongTuke has been tracked by Huntress since early 2025. Key characteristics: - Targets corporate/enterprise environments (domain-joined machines get RAT, standalone get test payloads) - SocGholish-inspired multi-layer obfuscation (Base64, XOR, ROT cipher, CharCode blobs) - Started using finger.exe LOLBIN in December 2025 - Anti-analysis: checks for 50+ analysis tools (Wireshark, IDA, Ghidra, etc.) and VM indicators - Progressive evolution: fake CAPTCHAs → fake updates → instruction videos → browser crashes → nslookup smuggling
**CLICKFIX ATTACK PARADIGM — BROADER CONTEXT:** ClickFix represents a paradigm shift in social engineering: instead of delivering malware through traditional infection vectors (exploit kits, malicious attachments), attackers trick victims into infecting themselves. This bypasses many security controls because the 'malware delivery' is the user executing a trusted system tool. Previous ClickFix campaigns delivered DarkGate, Lumma Stealer, and various info-stealers. The nslookup and CrashFix variants represent the continued evolution as defenders block earlier techniques.
MITRE ATT&CK techniques used in TL-2026-0118
discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1564.003 Hidden Window
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1129 Shared Modules; T1204.001 Malicious Link; T1204.002 Malicious File; T1559 Inter-Process Communication; T1569.002 Service Execution
command-and-control
T1071.001 Web Protocols; T1071.004 DNS; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
collection
persistence
T1176 Software Extensions; T1547.001 Registry Run Keys / Startup Folder
initial-access
resource-development
Remediation for ClickFix Evolution
Patches
- N/A — no software vulnerability; social engineering + LOLBIN abuse
Immediate actions
- BLOCK nslookup.exe execution by non-admin users via AppLocker/WDAC where operationally feasible
- BLOCK finger.exe execution entirely — no legitimate business use case in modern environments
- AUDIT Chrome extensions across fleet — remove any unknown or recently-installed extensions, especially NexShield
- USER AWARENESS: Brief all personnel that NO legitimate website or service will ever ask them to copy-paste commands into Windows Run dialog
- MONITOR clipboard manipulation by browser extensions — Malwarebytes Browser Guard detects this
Workarounds
- Restrict Windows Run dialog access via Group Policy for standard users
- Deploy clipboard monitoring/protection to detect and block malicious clipboard injection by web pages
- Block known C2 infrastructure: 199.217.98[.]108, 170.168.103[.]208, 158.247.252[.]178, nexsnield[.]com
Longer-term hardening
- APPCONTROL: Implement application whitelisting (AppLocker, WDAC) to restrict execution of LOLBINs (nslookup, finger, mshta, certutil) to authorized contexts
- DNS MONITORING: Monitor DNS TXT record queries — legitimate nslookup usage rarely queries TXT records; attacker DNS smuggling heavily uses them
- EXTENSION MANAGEMENT: Use Chrome Enterprise policies to restrict extension installation to approved-only list
- EDR TUNING: Add detection for nslookup.exe and finger.exe spawned from user-initiated Run dialog (explorer.exe → cmd.exe → nslookup.exe chain)
- SECURITY AWARENESS TRAINING: Regular ClickFix-specific training — the attack works because users don't understand what they're executing
Timeline of ClickFix Evolution
- ClickFix social engineering technique emerges in the wild. Initial campaigns use fake CAPTCHAs and 'Human Verification' screens to trick victims into pasting malicious PowerShell commands. Primarily delivers info-stealers and RATs.
- Huntress begins tracking KongTuke threat actor group. KongTuke specializes in ClickFix-style social engineering with multi-layer obfuscation inspired by SocGholish. Targets enterprise/corporate environments specifically.
- Malwarebytes documents ClickFix campaigns delivering DarkGate malware via malicious Google ads impersonating Notion. Campaign alternates between ClickFix (copy-paste) and traditional file download, testing which yields higher conversion. Source: https://www.malwarebytes.com/blog/news/2025/01/clickfix-vs-traditional-download-in-new-darkgate-campaign
- ClickFix campaigns add instruction videos showing users how to copy-paste commands. Also introduces fake Windows update screens as social engineering lures. Technique becoming increasingly sophisticated.
- KongTuke begins using finger.exe (Windows LOLBIN) for payload delivery. Finger.exe copies to %temp%\ct.exe, connects to C2, pipes response to cmd for direct execution. Novel LOLBIN abuse.
- Malicious Chrome extension 'NexShield – Advanced Web Protection' found live on official Chrome Web Store. Near-exact clone of uBlock Origin Lite with 3,276 bytes of added malicious code. Developer email: alaynna6899@gmail.com. Source: Huntress.
- Huntress publishes detailed analysis of CrashFix variant: malicious NexShield extension deliberately crashes browser via DoS (1 billion chrome.runtime port connections), then displays fake security warning to trigger ClickFix command execution. ModeloRAT documented as new Python RAT. Source: https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke
- Malwarebytes independently covers CrashFix/NexShield campaign, confirming Huntress findings and noting ModeloRAT targets domain-joined hosts only. Source: https://www.malwarebytes.com/blog/news/2026/01/fake-extension-crashes-browsers-to-trick-users-into-infecting-themselves
- Microsoft Security Intelligence documents ClickFix campaigns using nslookup for DNS smuggling. New technique bypasses mshta/PowerShell blocks by using trusted DNS tool to retrieve encoded payloads via DNS TXT records. Source: https://x.com/MsftSecIntel/status/2022456612120629742
- Malwarebytes publishes detailed coverage of nslookup ClickFix variant. Infection chain: fake CAPTCHA → nslookup DNS query → ZIP download → Python recon → VBS dropper → ModeloRAT. Confirms mshta/PowerShell increasingly blocked, nslookup is the EDR bypass. Source: https://www.malwarebytes.com/blog/news/2026/02/clickfix-added-nslookup-commands-to-its-arsenal-for-downloading-rats
- As of 2026-05-29, this KongTuke ClickFix/CrashFix/ModeloRAT campaign remains active: Trend Micro MDR (Mar 2026) confirms KongTuke still operating, and Malwarebytes (May 26) reports 700+ sites hijacked in live ClickFix attacks. No CVE to patch (social engineering/LOLBIN abuse), no actor takedown, and no successor supersedes it.
Sources cited for ClickFix Evolution
Threats related to ClickFix Evolution
- KongTuke ClickFix Campaign — ModeloRAT Deployment via Compromised WordPress Sites and CrashFix Browser Extension
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector (CrashFix, FileFix, ConsentFix Variants)
- ClickFix, CrashFix, InstallFix, FileFix & GhostClaw: Growing Family of Copy-and-Paste Social Engineering Attacks
Detection coverage for TL-2026-0118
As of 2026-02-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0118 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.