A newly reported campaign nicknamed “Detour Dog” quietly compromised more than 30,000 websites by abusing Domain Name System (DNS) logic to redirect visitors and deliver malware, including the Strela info-stealer. Below we break down what happened, why it matters for small and medium-sized businesses, and the practical steps to protect your organization.
What happened
Researchers observed attackers tampering with website infrastructure and server-side DNS behavior so that the website made special DNS queries and, in certain conditions, redirected visitors to malicious content. Because these look like normal DNS operations and occur on the server side, the activity is easy to miss during routine scans.
Why this attack is so sneaky
- DNS-level control: Malicious instructions were delivered through DNS (including TXT responses), letting attackers steer traffic or fetch code without obvious on-page clues.
- Conditional delivery: Redirects only trigger for certain geos/devices/IPs, keeping the campaign low-noise and hard to reproduce.
- Long dwell time: DNS-layer manipulation can persist for months without targeted DNS and web telemetry.
What Strela Stealer actually steals
Strela is an “infostealer” that focuses on harvesting email credentials—notably from Microsoft Outlook and Mozilla Thunderbird—and increasingly from browsers and other sources. Stolen logins fuel Business Email Compromise (BEC), payroll fraud, cloud takeovers, or can be sold for further intrusions.
How to check if you’re affected
- Audit DNS and registrar access: Review A/CNAME/TXT records, recent changes, API tokens, and user roles. Turn on change logging.
- Inspect redirects: Check server configs, reverse proxies,
.htaccess, CMS settings, and any plugin/module that can alter redirects. - Hunt in logs: Look for unusual referrers, user-agent spikes, or geo-specific anomalies in WAF/CDN and web logs.
- Sweep endpoints: Run EDR/AV hunts for infostealers, browser credential dumpers, and persistence mechanisms on admin workstations and web servers.
- Rotate credentials + enforce MFA: Email, registrar/DNS, CMS, hosting, and critical SaaS. Assume saved credentials may be exposed.
Preventive steps we recommend
1) Lock down your domain & DNS
- Enable MFA at your registrar/DNS provider; restrict roles and rotate API tokens.
- Set up change alerts for DNS edits and retain logs.
- Use protective DNS that inspects queries and blocks known-bad destinations.
- Consider DNSSEC to improve record integrity (not a silver bullet).
2) Harden your website & endpoints
- Patch CMS, plugins, and themes; remove abandoned components.
- Deploy a WAF/CDN with bot management and OWASP rules.
- Run EDR on all workstations/servers; block credential dumping and suspicious browser injections.
- Apply least-privilege on web hosts; separate admin/publisher roles; enforce SSO/MFA.
3) Add monitoring for changes & anomalies
- Continuously monitor DNS for drift; alert on unexpected TXT/redirect patterns.
- Enable UEBA/SIEM detections for mass email-rule changes, repeated failed logins, and unusual data egress.
- Back up site code/configs; test restores and keep periodic offline copies.
If you suspect compromise: 5 immediate steps
- Freeze DNS changes and rotate registrar/DNS credentials and API tokens.
- Remove malicious records, redirects, or injected code; redeploy clean artifacts.
- Force credential resets (email, CMS, hosting, SaaS) and enforce MFA.
- Re-baseline endpoints involved in admin work or site maintenance; image if needed and rescan.
- Notify impacted users if credentials or personal data may be exposed; involve legal/compliance as required.
How Landon Technologies can help
We offer a rapid DNS & Website Integrity Check for SMBs: registrar/DNS hardening, DNS drift review, CMS/plugin audit, WAF/EDR validation, and continuous monitoring options. Need help now? Schedule a quick consult or call us.
Explore our related services: Cybersecurity Services · Managed IT Services · Remote IT Support · Disaster Recovery Services
DNS Malware: Frequently Asked Questions
Does 8.8.8.8 block malware?
No, 8.8.8.8 — which is Google Public DNS — does not primarily function as a malware-blocking DNS service. Its main purpose is fast and reliable DNS resolution, helping devices translate website names into IP addresses. While Google Public DNS may provide some basic protections against certain dangerous or invalid domains, it is not designed to actively filter malware, phishing sites, adult content, or malicious traffic the way dedicated security-focused DNS services do.
What are the signs of DNS hijacking?
Common signs of DNS hijacking include being redirected to the wrong websites, seeing unexpected advertisements or pop-ups, security certificate warnings, unusually slow browsing, fake login pages, or websites looking different than normal. Other warning signs can include changes to your DNS settings without permission, antivirus alerts about suspicious network activity, inability to reach certain websites, or multiple devices on the same network experiencing strange browsing behavior. DNS hijacking occurs when attackers manipulate DNS settings or responses to redirect internet traffic to malicious or fraudulent websites.
How to test malware blocking DNS?
You can test a malware-blocking DNS service by using safe test domains specifically designed to verify DNS filtering without exposing your device to real malware. Security-focused DNS providers such as Quad9, Cloudflare Family/Malware DNS, and Cisco Umbrella often provide official test URLs or blocked-domain examples.
What are the most common DNS attacks?
Some of the most common DNS attacks include DNS hijacking, DNS spoofing (cache poisoning), DNS tunneling, DDoS attacks against DNS servers, and NXDOMAIN attacks. DNS hijacking redirects users to malicious websites by changing DNS settings, while DNS spoofing injects false DNS information into caches so users are sent to fraudulent destinations. DNS tunneling hides malicious traffic inside DNS queries to bypass security controls, and DNS-based DDoS attacks overwhelm DNS servers to disrupt internet access. Attackers also use NXDOMAIN floods and amplification attacks to overload systems and degrade network performance.
Sources & Further Reading
- TechRadar: Dangerous DNS malware infects over 30,000 websites — be on your guard (Oct 3, 2025)
- Infoblox Threat Intel: Detour Dog — DNS malware powers Strela Stealer campaigns (Sep 30, 2025)
- IBM X-Force: Strela Stealer — “Today’s invoice is tomorrow’s phish” (Nov 2024)
- Palo Alto Networks Unit 42: Large-Scale StrelaStealer Campaign in Early 2024 (Mar 22, 2024)
- MITRE ATT&CK: StrelaStealer (S1183) (Last updated Mar 10, 2025)
- NSA/CISA: Selecting a Protective DNS Service (Apr 2025)
Last checked: Oct 3, 2025
🛡️ Cybersecurity
🛡️ Stay Ahead of Cyber Threats
Get the latest security insights and tips in our
👉 Cybersecurity Blog Category