New DNS Malware ‘Detour Dog’ Uses TXT Records to Deliver Strela Stealer

Detour Dog, a stealthy website malware campaign tracked since February 2020, has evolved into a DNS-based command-and-control distribution system that delivers the Strela Stealer via DNS TXT records. Tens of thousands of compromised websites generate server-side DNS requests, enabling conditional redirections and remote code execution.

From spring 2025, name servers began responding to specially formatted DNS TXT queries with Base64-encoded “down” commands, instructing the compromised sites to fetch and execute PHP scripts from remote C2 servers, marking the first time Detour Dog has delivered malware directly to home users. In June 2025, researchers observed Detour Dog infrastructure hosting the StarFish backdoor, with analysis revealing that 69% of confirmed StarFish staging hosts were under Detour Dog control.

Passive DNS logs from 6–8 August 2025 show over 39 million TXT queries in 48 hours from about 30,000 infected hosts across 584 TLDs, with the United States accounting for 37% of distinct visitor IPs; according to Shadowserver Foundation, sinkhole data captured these events after the primary C2 domain webdmonitor[.]io was sinkholed and quickly replaced by aeroarrows[.]io.