Hackers are now using one of the internet’s most trusted systems to sneak malware into computers without being noticed. This system is called DNS, which stands for Domain Name System. It’s what helps your computer find and connect to websites.
But instead of just helping you reach web pages, DNS is now being used by attackers to hide malicious software in plain sight. This method is so subtle that even antivirus programs and firewalls often can’t detect it.
How Malware Is Hidden in DNS
Hackers have found a clever way to hide harmful code inside something called a DNS TXT record. TXT records are normally used to store text information about websites, but they can also be misused.
To carry out the attack, the malware is first converted into hexadecimal code — a format that looks like long strings of numbers and letters. This hex code is then broken into many small pieces.
Each piece is placed inside a TXT record linked to a unique subdomain name, such as “randomname.whitetreecollective.com.” These subdomains don’t look suspicious because DNS queries like this are very common.
When hackers gain even limited access to a computer network, they send DNS requests to collect these small pieces one by one. Once they’ve pulled all the parts, they reassemble and decode the malware into a working program.
All of this happens silently and quickly. Most security tools don’t inspect DNS TXT records deeply, which is why the attack goes unnoticed. The malware enters the network through a system everyone trusts and few people watch closely.
Why These Attacks Are So Hard to Detect
One of the reasons this method works so well is because DNS traffic is usually ignored by most security tools. DNS is used every time you visit a website, so it’s seen as safe and necessary. Most systems don’t monitor it closely.
The rise of encrypted DNS adds another layer of difficulty. Technologies like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) are designed to protect user privacy by hiding DNS requests from outside observers. But this also means that cyberattacks using DNS can be hidden inside encrypted traffic.
Even advanced security systems struggle to detect malicious activity hidden in DNS when encryption is involved. Unless an organization controls its own DNS servers and uses deep packet inspection, the dangerous data remains invisible.
🌐 Digital Guardian Awakens—Google’s Big Sleep AI Shuts Down Stealth Cyber Invasion
Researchers have also found that hackers are using DNS TXT records to carry out prompt injection attacks. These are specially crafted messages designed to trick AI chatbots and language models into doing things they shouldn’t — like leaking private information or making false claims.
So, this method of attack not only delivers malware but can also be used to manipulate AI systems by feeding them dangerous or misleading instructions through hidden DNS queries.
The New Face of Cyber Threats
This discovery shows how even basic parts of the internet, like DNS, can be turned into tools for cybercrime. It’s a reminder that not all threats come through emails or suspicious links. Some are hidden in places that look normal and go completely unnoticed.
Attackers are now exploiting systems that are usually ignored, trusted, or encrypted — and that makes these attacks more dangerous than ever. While some companies are starting to monitor DNS traffic more closely, many are still unaware that this kind of threat even exists.
As DNS continues to be used in this way, security teams need to shift their attention toward parts of the internet they once considered harmless. Because when it comes to cybersecurity, even the simplest system can be turned into a weapon.
