Malware in DNS records
Malicious software can retrieve payload fragments stored in DNS TXT records, using DNS as a delivery channel. This is a defensive case study.
DNS TXT records can carry arbitrary text as well as domain policy and verification data. In this case, attackers stored malware payload fragments in TXT records for malicious software to retrieve. The risk comes from using DNS to store and deliver payload data, rather than from an innocent downstream tool mishandling an answer.
The case shows why defenders should treat unexpected DNS TXT content and unusual query patterns as potential signs of malware delivery. The exhibit focuses on the technique and its detection context without reproducing harmful implementation details.
Primary source: https://arstechnica.com/security/2025/07/hackers-exploit-a-blind-spot-by-hiding-malware-inside-dns-records/