TXT Malware Records
Hidden malicious payloads detected in TXT DNS records
Critical Security Risk
Malware payloads have been detected in your domain's TXT records. This indicates a serious compromise that requires immediate attention to prevent further damage.
Understanding TXT Record Malware
Attackers have discovered that DNS TXT records provide an excellent hiding place for malicious payloads. Unlike other DNS record types that have specific formatting requirements, TXT records can contain almost any text data, making them perfect for storing encoded malware, command and control instructions, or fragmented executable files.
The attack typically works by breaking large malware payloads into smaller chunks and storing them across multiple subdomains like chunk1.example.com, part2.example.com, or segment3.example.com. When the malware runs, it queries these TXT records, reassembles the payload, and executes it directly in memory without ever touching the hard drive.
We've seen everything from PowerShell downloaders encoded in base64 to complete Windows executables split across dozens of TXT records. The technique is particularly dangerous because most security tools don't monitor DNS TXT records for malicious content, and the traffic looks like normal DNS queries to security appliances.
Our scanner analyzes over 20 common subdomain patterns used by attackers and applies entropy analysis to detect high-randomness content that indicates encoding. We also check for over 50 different file signatures including Windows PE executables, Linux ELF binaries, PowerShell commands, and known malware families.
How We Detect TXT Malware
Our detection system goes far beyond simple keyword matching. We calculate Shannon entropy for each TXT record to identify high-randomness content that typically indicates base64 or hexadecimal encoding. Records with entropy scores above 4.5 bits per character are flagged for deeper analysis.
We scan over 20 subdomain patterns commonly used by attackers, including variations like chunk1, part2, segment3, and less obvious ones like api-temp or admin-test. Each TXT record is then checked against a database of over 50 file signatures, looking for magic bytes that indicate executable files, archives, or script content.
Common Attack Signatures We Detect:
Immediate Response Steps
If malware has been detected in your TXT records, you need to act quickly. The first step is documenting what you've found before making any changes - this evidence might be crucial for understanding how the attack happened and preventing future incidents.
Step 1: Document the Evidence
Before removing anything, capture screenshots and save copies of all malicious TXT records. Use these commands to audit your entire DNS configuration:
dig TXT yourdomain.com
dig TXT api.yourdomain.com
dig TXT chunk1.yourdomain.com
dig TXT admin.yourdomain.comStep 2: Remove Malicious Records
Log into your DNS management panel (Cloudflare, Route 53, or your domain registrar) and systematically remove all suspicious TXT records. Focus on:
- • Records containing long base64 or hex strings
- • Subdomains with names like chunk*, part*, or segment*
- • Any TXT records you didn't create for legitimate purposes
- • Records with high entropy or executable signatures
Step 3: Secure Your Environment
After removing the malicious records, investigate how they got there and prevent future attacks:
- • Change all DNS management passwords and enable two-factor authentication
- • Review DNS API keys and rotate any that might be compromised
- • Check for unauthorized users in your DNS management panel
- • Set up DNS change monitoring to alert you of future modifications
- • Consider using DNS security services like DNSSEC
Preventing Future Attacks
The best defense against TXT record malware is proactive monitoring and access control. Most attacks succeed because organizations don't monitor their DNS records for unauthorized changes or don't properly secure their DNS management credentials.
Set up DNS change monitoring through your provider's notification system or use third-party services that alert you whenever TXT records are added, modified, or deleted. Enable two-factor authentication on all DNS management accounts and regularly audit who has access to make DNS changes.
Consider implementing DNS security services that include malware detection capabilities. Many providers now offer real-time scanning of DNS records for suspicious content, which can catch malicious payloads before they're used in attacks.
Key Prevention Steps:
- • Enable DNS change notifications and monitoring
- • Use strong passwords and two-factor authentication
- • Regularly audit DNS records for unauthorized content
- • Restrict DNS management access to essential personnel only
- • Consider using DNS security services with malware scanning
- • Document and review all legitimate TXT record purposes
Last updated: January 8, 2026