Redazione RHC : 17 July 2025 09:07
Hackers have learned to hide malware in places where it is virtually impossible to trace: in DNS records that connect domain names to IP addresses. This technique allows them to download malicious binaries without visiting suspicious sites or using email attachments that are easily blocked by antivirus software. DNS traffic is often ignored by most security solutions.
As reported by DomainTools researchers, this technique has been recorded to distribute the Joke Screenmate malware, an intrusive software that interferes with the normal operation of a computer. Its binary code was converted to hexadecimal format and split into hundreds of fragments. These fragments were inserted into the TXT records of the subdomains of the whitetreecollective[.]com resource, which is the text field of the DNS record, commonly used, for example, to confirm domain ownership when connecting to Google Workspace.
Once inside a secure network, an attacker can send seemingly benign DNS queries, harvesting malware fragments and restoring them in binary format. This scheme is particularly effective in the context of the popular DNS query encryption technologies DNS over HTTPS (DOH) and DNS over TLS (DOT). These protocols make traffic opaque until it reaches the internal DNS resolver.
“Even large enterprises with their own resolvers have difficulty distinguishing legitimate DNS traffic from rogue traffic,” said Ian Campbell, an engineer at DomainTools. He added that the situation is becoming even more complex with the rise of DOH and DOT, especially for organizations that don’t use internal DNS query routing.
A similar method has long been used to pass PowerShell scripts via DNS, for example on a subdomain 15392.484f5fa5d2.dnsm.in.drsmitty[.]com—another example of using TXT records for malicious activity. In another post, Asher Falcon’s blog describes a method for retrieving files from TXT records in which the malware is encoded as text. This allows the malware to be distributed even via services that do not allow binary file downloads.
Researchers have also been drawn to DNS records containing strings for attacks on AI models, so-called prompt injection. These attacks allow hidden instructions to be embedded in the documents analyzed by the LLM model. Such commands can be interpreted as valid queries, opening the way to manipulate the behavior of the AI.
Among the clues found:
Campbell observes: “Like the rest of the Internet, DNS can be a strange and fascinating place.”
Redazione