you would see an unusual number of TXT requests pointed at a domain, and each set of subdomains requested would likely be repeated.

https://phoenixnap.com/kb/dns-record-types#TXT_Record

Story from July.

Source: https://dti.domaintools.com/malware-in-dns/