How are hackers using DNS blind spots to hide and deliver malware in 2026, and what can organizations do to detect and prevent these DNS-based cyber attacks?

Key takeaways

• Attackers hide malware pieces and PowerShell commands in DNS TXT records, so no suspicious download or email ever appears.
• Log DNS queries and flag unusual TXT lookups and large responses.
• Force clients to use your approved resolvers so you can see every query.

Table of Contents

• Introduction: The Hidden World Inside DNS
• What Are DNS Blind Spots?
• Real-World Discovery: Malware Hidden in DNS TXT Records
• Beyond Malware Files: PowerShell Commands Hidden in DNS
• Why Is This Technique So Dangerous?
• Historical Context: This Isn’t New, But It’s Growing
• How DNS Tunneling Works (In Simple Terms)
• Key Elements of DNS Malware Delivery
• How Organizations Can Defend Against DNS-Based Malware Attacks
• Conclusion

Introduction: The Hidden World Inside DNS

Imagine receiving no suspicious email, no visible file download, and no malicious link, and yet malware sneaks into your network. That’s exactly what’s happening with a new breed of cyberattacks exploiting DNS (Domain Name System) blind spots.

DNS, which translates website names like google.com into IP addresses, has become an unexpected vector for malware storage and delivery. In 2026, security researchers uncovered sophisticated techniques where hackers hide malware inside DNS TXT records, turning internet infrastructure into a stealth malware delivery system.

What Are DNS Blind Spots?

DNS blind spots refer to areas in DNS traffic and configuration that security tools typically ignore. While organizations monitor emails, web traffic, and executables, DNS queries often go unchecked. This gap allows cybercriminals to exploit DNS as:

• A covert file storage platform.

• A channel for Command-and-Control (C2) communication.

• A medium for malware delivery.

Real-World Discovery: Malware Hidden in DNS TXT Records

Using tools like DNSDB Scout, researchers found attackers storing entire executable files inside DNS TXT records. TXT records are meant to store simple domain-related text, but attackers abuse them to hide file fragments.

Example Case:

Domain: *.felix.stf.whitetreecollective[.]com

• Hundreds of subdomains were observed.

• Each subdomain contained a small piece of malware in hexadecimal format.

• Researchers reassembled these fragments into fully working malware samples.

Reconstructed Malware Hashes:

This malware displayed disruptive behavior such as fake warnings, blocking user controls, and causing performance degradation.

Beyond Malware Files: PowerShell Commands Hidden in DNS

Another disturbing find involved malicious PowerShell commands embedded in TXT records on domains like drsmitty[.]com.

These encoded scripts communicated with a Covenant C2 server at cspg[.]pw, using a stager script to deliver follow-up malware payloads.

• Endpoint observed: /api/v1/nps/payload/stage1

• Technique: No visible file download; everything happens through DNS traffic.

Why Is This Technique So Dangerous?

Most security systems focus on:

• Email filters

• Web traffic monitoring

• File-based antivirus detection

But DNS queries are often treated as mere infrastructure chatter. Here's why that’s dangerous:

Historical Context: This Isn’t New, But It’s Growing

• First Observed: Similar C2 traffic techniques were identified as far back as 2017.

• Current Trends: Research shows 90% of malware uses DNS in its kill chain.

• Rising Encryption Use: Technologies like DNS over HTTPS (DoH) and DNS over TLS (DoT) are being abused to hide malicious DNS queries under the veil of privacy.

How DNS Tunneling Works (In Simple Terms)

Think of DNS tunneling like sending secret messages using puzzle pieces. Instead of sending one obvious, large file, the malware breaks it down:

1. Convert File to Hexadecimal
   Malicious file gets converted into small hexadecimal chunks.

2. Store in TXT Records
   Each chunk is placed into a TXT record across many subdomains.

3. Reassemble Upon Retrieval
   Malware in the victim’s system queries each subdomain, collects all the pieces, and reassembles the original malicious file.

 Key Elements of DNS Malware Delivery

How Organizations Can Defend Against DNS-Based Malware Attacks

1. Implement Full DNS Monitoring

Use tools that inspect DNS logs for anomalies like:

• Unusual TXT record sizes.

• Excessive subdomain queries.

• Patterns resembling file reassembly.

2. Deploy DNS Filtering Solutions

Block known malicious domains proactively and use threat intelligence feeds focused on DNS abuse.

3. Enforce Strict DNS Security Policies

Combine DNSSEC, SPF, DKIM, and DMARC for domain security and integrity validation.

4. Monitor for Encrypted DNS Abuse

Use technologies that can detect suspicious encrypted DNS traffic patterns.

5. Educate Security Teams

Ensure IT and cybersecurity teams understand DNS attack vectors and regularly review DNS traffic.

Conclusion: Treat DNS as a Security Priority, Not an Afterthought

The revelation that attackers are storing executable files, PowerShell commands, and malware payloads inside DNS TXT records highlights a critical vulnerability in modern cybersecurity strategies.

Organizations can no longer afford to overlook DNS as just a simple background service. With 90% of malware using DNS in its lifecycle, DNS security must become a frontline defense component.

By investing in DNS monitoring, filtering, and threat hunting capabilities, businesses can close this blind spot and protect themselves against one of 2025’s most stealthy and dangerous cyber threats.

To take this further with guided labs and an instructor, see our hands-on SOC analyst labs.

Related reading

• What Are the Top 10 DNS Attack Types in 2026? Full Guide with Examples, Techniques, and Prevention
• Can SVG Files Contain Malware? Understanding How Attackers Use SVGs for JavaScript-Based Phishing (2026 Guide)
• What are the different types of DNS attacks and how can SOC teams prevent them in 2026?

Reference

For the authoritative details, see IETF RFCs.