Hackers are stashing malware in a place that’s largely out of the reach of most defenses—inside domain name system (DNS) records that map domain names to their corresponding numerical IP addresses.

A hot chocolate-loving computer whiz uncovered data the car company claimed didn't exist. Here's how he did it.