DNShijacking

DNS hijacking is a term used to describe unauthorized manipulation of the Domain Name System (DNS) to redirect a user’s traffic from legitimate internet destinations to malicious ones. This can occur at various points in the DNS chain, including the domain’s authoritative records, the DNS hosting provider, recursive resolvers, or the end-user’s device. The result is that queries are answered with incorrect IP addresses, causing users to reach attacker-controlled servers instead of the intended sites.

Attack vectors include altering domain name records at a registrar or DNS provider so that an attacker controls the authoritative DNS for a domain; compromising a recursive resolver or ISP infrastructure to inject fraudulent responses; and infecting end-user devices or home routers to change DNS settings or host file entries. In some cases, attackers leverage phishing, malware, or social engineering to gain access to accounts that control DNS records. DNS hijacking can also occur as part of broader campaigns such as pharming, where multiple targets are redirected without their knowledge.

Impact typically includes credential theft, malware distribution, phishing, data breach exposure, financial loss, and reputational damage to brands. The redirection may be transient or persistent, depending on the attacker’s access and the speed with which defenders detect and remediate the compromise.

Defensive measures emphasize securing registrar and DNS hosting accounts, using DNSSEC to provide authenticity of DNS data, and adopting privacy-respecting and integrity-providing resolvers such as DNS over HTTPS or DNS over TLS. Network operators can monitor DNS changes, harden routers and endpoints, apply timely software updates, and implement incident response plans to detect and mitigate DNS hijacking quickly.