What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
In a DNS-based ClickFix attack disclosed by Microsoft, a victim is persuaded to run a command that uses nslookup against an attacker-controlled DNS server. The command extracts the response’s Name: value and runs it as the next stage. Microsoft reported that this campaign continued with a Python bundle and ultimately deployed ModeloRAT. The specific lure used in this case has not been established.
How the DNS-based ClickFix attack works
ClickFix is a social-engineering technique: attackers present a fake problem or verification prompt and persuade someone to copy, paste, and run a command. Microsoft says ClickFix lures in campaigns generally can arrive through phishing, malvertising, or drive-by pages, and may use fake CAPTCHA or “fix this issue” prompts. Those are examples of the broader technique, not confirmed details of this DNS-based campaign. [Microsoft Security Blog]
- A person runs a supplied command. The reported command is launched through
cmd.exe; ClickFix commonly relies on the victim entering it through a command interface such as Windows Run. nslookupqueries a specified DNS server. Instead of relying on the computer’s configured resolver, the command targets a hard-coded external DNS server controlled by the attacker.- The command turns the DNS response into executable content. It filters the output for the
Name:response and executes the returned content as the next stage. DNS is thus used to stage or signal the payload, rather than relying on a conventional web request for that step. - The next stage retrieves and runs malware. Microsoft reported that the subsequent chain downloaded a ZIP containing a portable Python bundle and malicious Python code. The script performed host and domain reconnaissance, created persistence, and deployed ModeloRAT, a remote access trojan. [Microsoft Threat Intelligence]
What is known about the campaign—and what is not
The Microsoft-attributed description establishes the command, DNS response parsing, and reported malware chain. It does not establish the exact wording of the lure or the landing-page pretext. Do not assume this case used a fake CAPTCHA: that is a known ClickFix lure generally, but it has not been confirmed for this campaign.
Microsoft reported these campaign-specific persistence locations: %APPDATA%WPy64-31401pythonscript.vbs and the startup shortcut %STARTUP%MonitoringService.lnk. They are useful as contextual indicators, not universal ClickFix signatures. Infrastructure can also change: BleepingComputer reported on February 15, 2026, that the observed DNS server was no longer available at the time of publication. Check current threat intelligence before treating a domain or server as live or relying on it for blocking. [BleepingComputer]
#1 Best Overall
- 24/7 Surveillance: The 22 inch monitor features 1920x1080 Full HD, 100% sRGB color accuracy, and 300cd/㎡ brightness, making it perfect for a security camera monitor. Ideal for 24/7 surveillance, it delivers clear, vibrant visuals for continuous use.
- 75Hz Refresh Rate: The 75Hz refresh rate combined with a 5ms response time ensures smooth and responsive performance, providing exceptional clarity for security and surveillance applications. This security monitor is engineered for continuous use as a CCTV monitor or camera monitor, offering clear, fluid visuals for your monitoring needs.
- Multiple Interfaces: The video monitor offers versatile connectivity with HDMI, VGA, AV, BNC, and USB ports, making them compatible with a wide range of devices, including DVR/NVR systems and computers, and gaming consoles. Whether you're using it for office work, gaming, or surveillance monitoring, it can easily adapt to your needs.
- Mirror Flip Function: The computer screen can function as a teleprompter, supporting a mirror flip function that allows you to easily adjust the display orientation for various applications, whether for presentations, multi-monitor setups, or surveillance monitoring.
- Two Mounting Options: Eyoyo bnc monitor offers two mounting options: one for desktop installation and the other for a 100x100mm VESA mount (not included). Whether you're using it as a security monitor in a surveillance setup, for daily tasks in the office, or as part of a home theater system, the flexibility of these mounting options ensures it fits seamlessly into your environment.
How defenders can detect DNS-based staging
A single nslookup command is a normal administrative action, not proof of compromise. The useful signal is the surrounding sequence: user activity, shell execution, an unusual DNS query, and follow-on downloads, scripts, file writes, or persistence.
- Review command-line telemetry. Look for
cmd.exelaunchingnslookupwith an explicit external resolver, especially when it is followed by output filtering or execution of returned text. Treat this as a behavioral lead to investigate, not a standalone detection rule. - Correlate DNS with endpoint events. Where logging allows, connect the lookup to the initiating process and user, then examine nearby script execution, archive or file creation, Python activity, and startup-folder changes.
- Look for the sequence, not only known indicators. Known server names, paths, and command strings can help identify a documented incident, but indicators can become stale and ClickFix has multiple execution and obfuscation methods. Microsoft recommends focusing on behavioral signals in addition to static indicators. [Microsoft Digital Defense Report 2025]
- Investigate related user and browser behavior. Microsoft recommends monitoring unusual clipboard activity followed by shell launches, hardening browsers, and correlating clipboard activity with later execution. These signals can help reveal the social-engineering-to-execution chain.
Practical steps to reduce risk
- Teach users not to run commands from prompts or webpages. Pasting a command from an unknown source is as risky as clicking a suspicious link. Users should verify an unexpected repair or verification request through a trusted channel rather than running its instructions.
- Enable script visibility and controls. Microsoft’s guidance includes enabling PowerShell logging and Constrained Language Mode, alongside endpoint and web protection. These measures support investigation and can limit some script-based activity; they do not by themselves prevent every ClickFix chain.
- Use layered monitoring. Combine endpoint process and script telemetry with DNS visibility and current threat intelligence. Static blocks can stop known infrastructure, but they cannot cover every changed server or modified command.
How to interpret Microsoft’s 47% figure
Microsoft’s Digital Defense Report 2025 says ClickFix accounted for 47% of initial-access methods in Microsoft Defender Experts notifications over the preceding year. That percentage describes this specific set of notifications; it is not an estimate that ClickFix was responsible for 47% of all cyberattacks. The report also says traditional phishing protections will not catch ClickFix on their own, emphasizing behavioral detection and user awareness.
Quick Recap
Best Value
- BUSINESS CYBERSECURITY SOLUTION: SafeBiz is an advanced cybersecurity solution that protects your work network and safeguards your Business data and all internet connected devices in your business from cyber threats and hackers. SafeHome blocks phishing, malware, ransomware, online scams and dark web threats.
- ADVANCED THREAT PREVENTION: SafeBiz includes a Next-Gen Firewall, DNS Security, Web Filtering, Dark Web Protection, Geo-fencing and other AI Powered cybersecurity features protecting your Business and Sensitive Data from internet threats and hackers.
- BUSINESS DATA & IDENTITY SECURITY: Safeguards your Official and financial data, protecting them from online theft and unauthorized access.
- EASY SETUP: Connects effortlessly to any existing wireless router or internet connection, setting up in minutes without the need for any changes to your Business internet connection.
- HIGH SPEED CONNECTIVITY: Supports an aggregate throughput of up-to 4.3 Gbps, maintaining high-speed browsing and streaming performance for up to 128 devices.
Rank #4
- 17-Inch Security Monitor: 1280x1024 resolution, 72% NTSC color accuracy, and 250cd/m² brightness for clear, vibrant visuals. Perfect for security camera surveillance with a 5:4 aspect ratio for precise, detailed monitoring
- Smooth Visual Experience: This square monitor features a 75Hz refresh rate for smoother motion and reduced screen flicker, making it perfect for gaming, video streaming, and everyday tasks. Enjoy more fluid visuals, less motion blur, and greater comfort for long hours of use
- Versatile Connectivity: This CCTV monitor is equipped with HDMI, VGA, AV, BNC, and USB ports for easy connection to security cameras, DVR systems, PCs, DVD players, and PS5 consoles, ensuring seamless integration for all your surveillance and entertainment needs
- Mirror Flip Feature: Introducing small computer monitor with mirror flip functionality, allowing for effortless image rotation. It’s perfect for applications like Teleprompter or security camera monitoring, offering optimal viewing angles for a variety of uses
- Reliable 24/7 Monitoring: Ensures continuous, real-time tracking and system performance without interruptions, making it perfect as a security camera monitor for critical environments like security, data centers, and industrial operations
Rank #3
Rank #2
- 24/7 Surveillance: Engineered for round-the-clock surveillance, the CCTV monitor features enhanced W-LED technology for improved visibility. With a 3000:1 contrast ratio and 16.7M display colors, it ensures exceptional image quality. Its Full HD 1920x1080 resolution guarantees sharp clarity.
- 75Hz Refresh Rate: The security monitor boasts a 75Hz refresh rate, ensuring a seamlessly smooth picture with a response time of 4ms. Its wide viewing angle of 178°/178° guarantees ultra-clear details from any perspective, providing an unimpeded viewing experience. Designed for CCTV monitoring support most DVR/NVR brands.
- Sleek and Compact Design: Real HD 22-inch computer monitor features an ultra-slim, edgeless design that enhances the overall picture continuity when multiple monitors are connected. It serves as an excellent business display for desktops or home laptops.
- Easy to use: Come with 1 x HDMI, 1 x VGA and 1 x headphone jack (audio in)
- Notice: This is a professional security monitoring monitor. It does not have Bluetooth functionality and does not support WiFi, so it cannot work with WiFi security cameras or other wifi devices.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
