PowerShell‑Based Malware Leverages Registry and DNS TXT Records to Install XMRig Miner

A newly uncovered malware campaign is using a chain of obfuscation techniques to hide a PowerShell payload that ultimately installs an XMRig cryptocurrency miner on compromised Windows machines.

The attack begins with a PowerShell script that is deliberately concealed through a combination of Windows Registry entries and DNS TXT records. Researchers observed that the malicious code is split across several registry values, each storing a small, encoded fragment that the script reassembles at runtime. The same fragments are also mirrored in TXT records hosted on attacker‑controlled domains, providing a secondary retrieval path that can bypass simple file‑system monitoring.

Beyond the registry and DNS layers, the campaign adds further stealth by embedding additional payload components inside seemingly innocuous PNG images and WAV audio files. When the PowerShell script executes, it extracts the hidden data from these media files, decodes it, and stitches together the final binary that launches the XMRig miner.

XMRig is a widely used open‑source miner for Monero, a privacy‑focused cryptocurrency. By hijacking victim CPUs, the malware can generate a steady stream of illicit revenue without requiring user interaction. Because the miner runs as a background process, it often goes unnoticed until system performance degrades or power consumption spikes.

The multi‑stage obfuscation makes detection challenging for conventional antivirus solutions, which typically scan for known file signatures or monitor network traffic for suspicious domains. By dispersing the malicious code across registry keys, DNS records, and steganographically altered media, the attackers increase the likelihood that any single defensive layer will miss the threat.

Security analysts, including those at GBHackers who first reported the campaign, recommend a layered response: monitor for unexpected PowerShell activity, audit registry modifications that contain base64 or other encoded data, and inspect DNS queries for TXT record lookups to unfamiliar domains. Network defenders should also consider blocking outbound connections to known mining pool endpoints and applying strict execution policies for PowerShell scripts. Ongoing research aims to map the full infrastructure behind the campaign and develop signatures that can flag the distinctive combination of techniques used.