ClickFix Evolution — nslookup DNS Smuggling + CrashFix Browser DoS + ModeloRAT Python RAT, KongTuke Actor, Enterprise Domain-Joined Targeting — Threadlinqs Intelligence
As of 2026-05-30, ClickFix Evolution — nslookup DNS Smuggling + CrashFix Browser DoS + ModeloRAT Python RAT, KongTuke Actor, Enterprise Domain-Joined Targeting is a high-severity phishing threat attributed to KongTuke (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0118 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: KongTuke · N/A · financial
ClickFix social engineering campaigns have evolved with two major developments in early 2026: (1) nslookup DNS smuggling — abusing the built-in Windows DNS lookup tool to smuggle encoded payloads via
ClickFix is a social engineering attack paradigm where victims are tricked into infecting their own machines by copying and pasting malicious commands. The technique has been evolving rapidly since 2024, and in early 2026 two significant new variants emerged:
**EVOLUTION 1 — NSLOOKUP DNS SMUGGLING (February 2026):**
Microsoft Security Intelligence documented ClickFix campaigns now using nslookup, the built-in Windows DNS resolution tool, to smuggle malware payloads. The innovation: mshta.exe and PowerShell are increasingly blocked by EDR/AV solutions, so attackers pivoted to nslookup — a trusted, ubiquitous LOLBIN that is rarely monitored or blocked.
The attack chain:
1. Victim encounters fake CAPTCHA, browser crash, or update prompt
2. Social engineering instructs victim to copy-paste a command into Windows Run dialog
3. Command executes nslookup queries against attacker-controlled DNS server
4. DNS TXT records return encoded payloads/commands instead of normal DNS data
5. Downloaded ZIP archive contains malicious Python scripts
6. Scripts perform reconnaissance and discovery
7. VBS dropper deploys ModeloRAT (Python-based RAT)
Why nslookup works: It's signed by Microsoft, present on every Windows installation, typically whitelisted by EDR solutions, and its network traffic (DNS queries) blends with normal operations. Security teams rarely monitor nslookup execution or DNS TXT record content.
**EVOLUTION 2 — CRASHFIX BROWSER EXTENSION (January 2026):**
Huntress documented a new ClickFix variant dubbed 'CrashFix' deployed by the KongTuke threat actor. The attack uses a malicious Chrome extension called 'NexShield' that impersonates the legitimate uBlock Origin Lite ad blocker. The extension was distributed through the official Chrome Web Store, lending false legitimacy.
The CrashFix attack chain:
1. Victim searches for ad blocker, encounters malicious Google ad
2. Ad directs to Chrome Web Store listing for 'NexShield – Advanced Web Protection'
3. Extension is a near-exact clone of uBlock Origin Lite with 3,276 bytes of added malicious code
4. After 60-minute delay (Chrome Alarms API), extension triggers browser DoS
5. DoS loop creates billions of chrome.runtime port connections, exhausting resources
6. Browser becomes unresponsive and crashes
7. On restart, fake 'CrashFix' security warning appears
8. User is instructed to open Win+R, paste clipboard, press Enter to 'fix' the issue
9. Clipboard contains malicious command using finger.exe (LOLBIN) to fetch payload from C2
10. Payload chain: finger.exe → ROT-encoded PowerShell → script.ps1 → anti-analysis checks → domain-join check → ModeloRAT (domain-joined) or test payload (standalone)
**MODELORAT — NEW PYTHON RAT:**
ModeloRAT is a previously undocumented Python-based Remote Access Trojan reserved exclusively for domain-joined (corporate) hosts. Key capabilities:
- RC4 encrypted C2 communications over HTTP port 80
- Adaptive beaconing: 5min normal → 150ms active → 15min backoff
- System reconnaissance: OS version, processes, services, storage, ARP, network, privileges, TCP connections
- Persistence via HKCU\...\Run registry key with mimicked legitimate software names (e.g., 'Spotify47', 'Adobe2841')
- Payload execution: EXE, DLL, and Python script support
- Bundled WinPython for Python-independent execution
- Anti-analysis: verbose/misleading class names, string concatenation for IOCs, junk code padding, hidden window execution
- C2 servers: 170.168.103[.]208 and 158.247.252[.]178
**KONGTUKE THREAT ACTOR:**
KongTuke has been tracked by Huntress since early 2025. Key characteristics:
- Targets corporate/enterprise environments (domain-joined machines get RAT, standalone get test payloads)
- SocGholish-inspired multi-layer obfuscation (Base64, XOR, ROT cipher, CharCode blobs)
- Started using finger.exe LOLBIN in December 2025
- Anti-analysis: checks for 50+ analysis tools (Wireshark, IDA, Ghidra, etc.) and VM indicators
- Progressive evolution: fake CAPTCHAs → fake updates
Target sectors: enterprise, technology, corporate
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1566.002, T1204.001, T1204.002, T1059.001, T1059.005, T1059.006, T1059.003, T1569.002, T1547.001, T1176