Threat reportMalwareTL-2026-4327
ClickFix campaign abuses Windows 'finger' utility as LOLBIN to deliver NetSupport RMM and Lumma Stealer via Amazon Business malvertising
ClickFix campaign abuses Windows 'finger' utility as LOLBIN (TL-2026-4327), also tracked as Amazon-themed ClickFix finger campaign, is a high-severity malware campaign, first published 2026-10-24. It has no confirmed attribution, affects Microsoft Windows (built-in finger.exe), maps to 13 MITRE ATT&CK techniques (T1027, T1036, T1055.012), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4327
- Threat ID
- TL-2026-4327
- Also known as
- Amazon-themed ClickFix finger campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, ecommerce, business services, general enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in ClickFix campaign abuses Windows 'finger' utility as LOLBIN
Malware and tooling: Lumma Stealer - S1213, sRDI, NetSupport Client
How ClickFix campaign abuses Windows 'finger' utility as LOLBIN works
Huntress documented an Amazon-themed ClickFix campaign in which a sponsored Google result for "amazon business" leads to a spoofed Amazon login and fake CAPTCHA that makes the victim run the built-in Windows finger utility. The multi-stage chain drops Doina loader, a Node.js malware package, Lumma Stealer and a pirated NetSupport Client RMM.
Huntress investigated multiple incidents (at least three customers) stemming from a malvertising campaign tied to a sponsored Google search result for the keywords "amazon business". The ad URL pointed to orders-amazon-com.advancedfences.com, which redirected to a spoofed Amazon sign-in page hosted on sites.google.com. The page asked for an email or phone number and then displayed a fake CAPTCHA (ClickFix) that copies a command to the clipboard and instructs the user to paste it into the Windows Run dialog. Google has since removed the ad, but the attacker infrastructure remained online at publication.
The pasted command invokes finger.exe, a legacy Windows utility using TCP/79, as a living-off-the-land binary. The command is obfuscated with injected characters (commas, carets, hyphens, underscores) and queries a user on the attacker server grillrecipespro.com. The server's .plan response contains 68 carriage returns that hide the malicious script from casual viewing. The script downloads IronPython 3.4.2 from GitHub, extracts it to the Temp directory with a .pdf extension, and runs Base64/zlib-compressed Python through ipyw32.exe. That Python retrieves 'timer6' from grillmasterchef.com, a Base64 blob (with Cyrillic letter substitution) wrapping XOR-protected shellcode (19-byte key) for inline injection that borrows from the deprecated Veil framework.
The shellcode downloads the 'v6' payload, the Doina loader, whose first 64 bytes are the RC4 key; it is decrypted and injected into memory and looks for an .ini file holding further retrieval URLs. A separate stage downloads a ~52MB archive from kiriosyka.com containing a legitimate node.exe, package.json, node_modules and a malicious index.js, extracted to C:\ProgramData\NodeView. It checks in by HTTPS POST and then communicates over WebSocket; the server appends random null bytes to payloads and supports an exclude_bins=true update mode.
Lumma Stealer is delivered fileless as two GUID-named files (a ~17KB sRDI loader and a ~19MB AES-256-GCM encrypted stealer; first 12 bytes nonce, next 16 bytes key) and injected via reflective loading/process hollowing. It targets Chrome, Edge, Firefox and Opera, crypto wallets (Ledger, Electrum, Atomic Wallet), password managers (LastPass, Dashlane, 1Password, NordPass, RoboForm) and email clients. Check-in uses perfectgrillrecipes.com, exfiltration thegrilljournal.com and homelygrill.com, with liokida.com embedded. Finally, Client32.exe (NetSupport Client, using a pirated license over eight years old) is installed in C:\ProgramData\Prodclear and beacons over HTTPS to 167.148.201.106:725 (path fakeurl.htm); that IP serves a spoofed Detroit restaurant website. A macOS-targeted payload URL on ashevilleroofingcontractor.com was also observed. Earlier finger-based ClickFix clusters (KongTuke via captchaver.top; SmartApeSG via 91.193.19.108) were reported from Nov-Dec 2025, showing the technique is spreading. Attribution to a named actor was not made in the sources. Severity is an analyst judgment.
MITRE ATT&CK techniques used in TL-2026-4327
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Execution
T1059.006 Python; T1059.007 JavaScript; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in ClickFix campaign abuses Windows 'finger' utility as LOLBIN
- Microsoft — Windows (built-in finger.exe)
Vulnerable versions: Windows versions shipping finger.exe
Remediation for ClickFix campaign abuses Windows 'finger' utility as LOLBIN
Immediate actions
- Block the listed domains and 167.148.201.106 at DNS/proxy/firewall
- Block outbound TCP/79 (finger) and TCP/725 from endpoints
- Isolate hosts that ran finger.exe from the Run dialog and hunt for C:\ProgramData\NodeView and C:\ProgramData\Prodclear
- Reset credentials and revoke sessions for browsers, password managers and wallets on affected hosts
Workarounds
- Remove or block finger.exe via application control where not needed
- Disable the Run dialog via Group Policy for standard users
Longer-term hardening
- Train staff that being asked to paste commands into Run/Terminal is a red flag
- Restrict the Windows Run dialog for non-administrative users (e.g. attack-reduction policies)
- Alert on finger.exe execution and on unapproved NetSupport (client32.exe) deployments
- Review web filtering and sponsored-search abuse controls
Timeline of ClickFix campaign abuses Windows 'finger' utility as LOLBIN
- Finger-based ClickFix activity (KongTuke via captchaver.top, SmartApeSG via 91.193.19.108) reported active since approximately November 2025
- Public reporting describes ClickFix lures invoking finger.exe over TCP/79 to fetch Base64-encoded PowerShell from attacker servers
- Google removes the malicious sponsored ad; attacker infrastructure remains online and functional
- Huntress publishes analysis of the Amazon Business malvertising ClickFix campaign using finger to deliver Doina, Node.js malware, Lumma Stealer and NetSupport RMM
- Petri and other outlets report the campaign and recommend blocking port 79 and monitoring finger.exe
- Campaign added to Threadlinqs intelligence platform as an active malware threat
Sources cited for ClickFix campaign abuses Windows 'finger' utility as LOLBIN
- Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
- Decades-Old Windows Utility Powers Modern ClickFix Attack
- Researchers Warn of ClickFix Campaign Targeting Amazon Business Users
- New Clickfix Attack Exploits finger.exe Tool to Trick Users into Execute Malicious Code
- NetSupport RAT Campaign Evolves with ClickFix Technique
- Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers
- Fake CAPTCHA Lures Victims: Lumma Stealer Abuses Clipboard and PowerShell
Detection coverage for TL-2026-4327
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4327 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.