ClickFix DNS Payload Execution via NSLookup

Ethan Andrews@eandrews

•updated Feb 16, 2026•25•0•316

Detects a command-line pattern where nslookup is used to query a DNS server, and its output is piped to other commands to parse and execute a payload. This is a technique used by ClickFix campaigns to deliver malware via DNS.