ClickFix campaign uses Windows finger to install Lumma
Original title: Decades-Old Windows Utility Powers Modern ClickFix Attack
A sponsored Google result for “amazon business” opens a fake login and CAPTCHA that launches finger.exe and NetSupport.
Huntress researchers described a ClickFix attack that begins with a sponsored Google result for “amazon business.” The result used orders-amazon.com.advancedfences.com and redirected to a spoofed Amazon login on Google Sites with a fake CAPTCHA. Engaging the CAPTCHA calls Windows’ built-in finger utility as a living-off-the-land binary, starting a chain that drops a pirated NetSupport Client and Lumma Stealer. Google has removed the ad, but Huntress says the attacker infrastructure remains online, including barbecue-themed domains.
Unconfirmed: The Dark Reading excerpt ends before the full attack chain is described.
- Sarah Reddish and Spike Brandt documented the activity for Huntress.
- The fake login asks for an email or phone number before the CAPTCHA.
- Finger is described as an early-1970s utility abused as a LOLBin.
- Google removed the malicious ad; infrastructure was still functional.
Impact: Installs Lumma Stealer and NetSupport remote-management software
- 1.Treat fake CAPTCHAs that instruct users to run commands as malicious.
- 2.Watch for unexpected use of the Windows finger utility.
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | orders-amazon.com.advancedfences.com | ckers hosted the malicious result on a "suspicious" domain, orders-amazon[.]com[.]advancedfences[.]com, and the link redirected to a fake Amazon login page, |
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
7 min read at darkreading.com
The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
By Elizabeth Montalbano · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.