Hackers exploit a blind spot by hiding malware inside DNS records

Hackers are hiding malware in DNS records, exploiting a security blind spot. This method allows malicious scripts to fetch files without alerting antivirus systems. Researchers from DomainTools uncovered this technique using hex-encoded chunks of a malware binary hidden in the TXT records of the domain whitetreecollective[.]com.

Attacking networks can retrieve these chunks via standard DNS requests. Ian Campbell from DomainTools noted that encryption methods like DNS over HTTPS make detection tougher. The technique isn’t new but the hexadecimal method is less recognized.

Campbell also discovered prompts for hacking AI chatbots by embedding commands into documents.