Amazon-themed ClickFix uses finger.exe to deliver stealers
Original title: Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Huntress tied the chain to at least three customers; a macOS script URL was offline during research.
Huntress investigated incidents that began with a sponsored Google result for “amazon business,” leading to a spoofed Amazon login on Google Sites and a fake CAPTCHA. The CAPTCHA pastejacks an obfuscated command into the Windows Run dialog, which runs finger.exe against grillrecipespro.com and retrieves a script from a .plan file. The chain installs a pirated NetSupport Client, Lumma Stealer, and other infostealer or remote-access malware. Google removed the ad, while barbecue-themed attacker infrastructure remained online.
Unconfirmed: The macOS download URL was offline, so that branch was not seen executing.
- The sponsored host was orders-amazon.com.advancedfences.com.
- The fake login was hosted at sites.google.com/view/ch-pc/sign-in.
- Spaces and hyphens hide the real command in the Run dialog.
- Huntress says finger has been abused in ClickFix for at least a year.
- At least three Huntress customers were affected.
Impact: Infostealer and remote-access malware on victim computers
- 1.Alert on finger.exe retrieving content from unexpected remote hosts.
- 2.Warn users not to paste fake-CAPTCHA commands into the Run dialog.
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ashevilleroofingcontractor.com | lication, but the destination URL in that instance—hxxp[://]ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce |
| domain | grillmasterchef.com | this process retrieves and executes the content from hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6, and this is |
| domain | grillrecipespro.com | h a specific user account on the attacker-controlled domain grillrecipespro[.]com. The finger command is ancient, by internet standards, p |
| domain | homelygrill.com | h are all themed around barbeque: thegrilljournal[.]com and homelygrill[.]com are used for exfil after an initial check-in toperfectgri |
| domain | kiriosyka.com | unications, then retrieving a ZIP file from the URL hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6: a 52MB compressed file that c |
| domain | liokida.com | tgrillrecipes[.]com. The malware originates from the domain liokida[.]com (which, as far as we can tell, is not a barbeque term), a |
| domain | orders-amazon.com.advancedfences.com | ceptive-looking subdomain of an attacker-controlled domain: orders-amazon[.]com[.]advancedfences[.]com. The malicious link redirected to a fake Amazon logi |
| domain | thegrilljournal.com | e malware communicates with are all themed around barbeque: thegrilljournal[.]com and homelygrill[.]com are used for exfil after an initial |
| domain | toperfectgrillrecipes.com | elygrill[.]com are used for exfil after an initial check-in toperfectgrillrecipes[.]com. The malware originates from the domain liokida[.]com (wh |
| ipv4 | 167.148.201.106 | iosyka and Liokida domains We also observed an IP address (167.148.201.106) used as a C2 for the NetConnect Client RMM payload. The IP |
| sha256 | bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a | hat instance—hxxp[://]ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a—was offline at the time Huntress conducted this research. |
| url | http://grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/timer6 | ult of this process retrieves and executes the content from hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6, and this is where it gets interesting. Stage 2: Begin t |
| url | https://grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/v6 | tance, the loader connected to another barbeque-themed URL, hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6, and decrypted the contents, which was another malware ex |
| url | https://kiriosyka.com/KsxmmKiN5N0j/sqr-viewertr6: | OST communications, then retrieving a ZIP file from the URL hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6: a 52MB compressed file that contains a full, portable ins |
From the original article
13 min read at huntress.comA Google search for Amazon business led to a ClickFix lure that dropped multiple malicious payloads onto the victim machine, including versions of Lumma Stealer and NetSupport Client RMM.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.