DNSMessenger

Talos, Cisco's security research outfit, have been researching a unique attack DNSMessenger which uses DNS queries to carry out malicious PowerShell commands on affected computers.

According to the Talos experts the infection chain begins with a rigged Word document sent to recipients who are encouraged to “enable content” so they can view a message. If enabled the document launches a Visual Basic for Applications (VBA) macro script that opens the initial PowerShell command that ultimately leads to the multistage attack and the eventual installing of a remote access Trojan.

More details can be read in Talos blog post here.