#BoratRAT spreading using similar tactics as #ClickFix 👇 1️⃣ Fake Microsoft Security Verification 🔑 leading to malicious PowerShell execution 🖱️ 2️⃣ Command triggers a DNS TXT request to recapture-robot .today 🌐 to obtain a PowerShell script 📜 3️⃣ Script drops payload, infecting host with BoratRAT 💻 Payload delivery: 🌐 recapture-robot .today (PDR 🇮🇳) 🌐 91.193.7.186:49094 (M247 🇯🇵) Botnet C2: 📡 out-agent.duckdns .org 📡 91.193.7.186:48988 (M247 🇯🇵) 📄 Sample: https://bazaar.abuse.ch/sample/5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534/