ModeloRAT DNS-delivered malware staging
Malware Activity
Summary
Hide ▲
Show ▼
ModeloRAT is now being delivered through a DNS-based staging chain, increasing the chance that malicious traffic blends into ordinary name-resolution activity. In the observed ClickFix operation, victims are told to run nslookup, which returns a malicious PowerShell payload from an attacker-controlled DNS server. That staged execution then installs additional malware and persistence components before deploying ModeloRAT for remote control of compromised systems.
Related Happenings
ModeloRAT malicious PowerShell and Dropbox delivery activity
Malware Activity
H score16
First: 14.05.2026 15:12
Last: 14.05.2026 15:12
Sources 1
About this happening:
The ModeloRAT activity now uses a malicious PowerShell command and a Dropbox ZIP payload to gain persistent footholds, enabling system reconnaissance, screenshot...
ModeloRAT malicious PowerShell and Dropbox delivery activity
Malware ActivityAbout this happening: The ModeloRAT activity now uses a malicious PowerShell command and a Dropbox ZIP payload to gain persistent footholds, enabling system reconnaissance, screenshot...
Slopoly backdoor used in Interlock ransomware intrusion
Malware Activity
H score23
First: 12.03.2026 22:01
Last: 12.03.2026 22:01
Sources 1
About this happening:
The Slopoly backdoor was identified in an Interlock ransomware intrusion after it kept a compromised server active for more than a week and enabled data theft. It...
Slopoly backdoor used in Interlock ransomware intrusion
Malware ActivityAbout this happening: The Slopoly backdoor was identified in an Interlock ransomware intrusion after it kept a compromised server active for more than a week and enabled data theft. It...
A0Backdoor malware deployed through signed MSI sideloading and DNS MX C2
Malware Activity
H score22
First: 10.03.2026 00:50
Last: 10.03.2026 00:50
Sources 1
About this happening:
The A0Backdoor malware was deployed on Windows endpoints through digitally signed MSI installers and DLL sideloading, giving the operators a stealthier path to exe...
A0Backdoor malware deployed through signed MSI sideloading and DNS MX C2
Malware ActivityAbout this happening: The A0Backdoor malware was deployed on Windows endpoints through digitally signed MSI installers and DLL sideloading, giving the operators a stealthier path to exe...
Python-based malware deployment with XWorm and Cobalt Strike tooling
Malware Activity
H score28
First: 23.02.2026 17:30
Last: 23.02.2026 17:30
Sources 1
About this happening:
A Python-based malware deployment was uncovered on a compromised Windows system, exposing persistence, obfuscation, and credential-theft activity tied to PayPal abuse...
Python-based malware deployment with XWorm and Cobalt Strike tooling
Malware ActivityAbout this happening: A Python-based malware deployment was uncovered on a compromised Windows system, exposing persistence, obfuscation, and credential-theft activity tied to PayPal abuse...
CRESCENTHARVEST Windows RAT and info-stealer activity
Malware Activity
H score28
First: 19.02.2026 10:13
Last: 19.02.2026 10:13
Sources 1
About this happening:
The CRESCENTHARVEST malware activity centers on version.dll, a Windows RAT and information stealer that can execute commands, log keystrokes, and exfiltrate data. It m...
CRESCENTHARVEST Windows RAT and info-stealer activity
Malware ActivityAbout this happening: The CRESCENTHARVEST malware activity centers on version.dll, a Windows RAT and information stealer that can execute commands, log keystrokes, and exfiltrate data. It m...
Timeline
-
16.02.2026 02:29 2 articles · 5mo ago
Microsoft discloses ClickFix campaign using DNS to deliver PowerShell
Initial DisclosureMicrosoft describes a new ClickFix campaign in which victims are told to run nslookup in the Windows Run dialog box so a custom DNS lookup to 84[.]21.189[.]20 returns a malicious PowerShell payload, followed by additional malware staging, persistence through %APPDATA%\WPy64-31401\python\script.vbs and %STARTUP%\MonitoringService.lnk, and deployment of the remote access trojan ModeloRAT for remote control of compromised systems.
Show sources
- New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS — www.bleepingcomputer.com — 16.02.2026 02:29
- New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS — www.bleepingcomputer.com — 16.02.2026 02:29