# ClickFix campaign abuses Windows 'finger' utility as LOLBIN to deliver NetSupport RMM and Lumma Stealer via Amazon Business malvertising

> Huntress documented an Amazon-themed ClickFix campaign in which a sponsored Google result for "amazon business" leads to a spoofed Amazon login and fake CAPTCHA that makes the victim run the built-in Windows finger utility. The multi-stage chain drops Doina loader, a Node.js malware package, Lumma Stealer and a pirated NetSupport Client RMM.

- **Published:** 2026-10-24T01:03:53Z
- **Last reviewed:** 2026-10-24T01:03:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4327
- **ID:** TL-2026-4327
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress investigated multiple incidents (at least three customers) stemming from a malvertising campaign tied to a sponsored Google search result for the keywords "amazon business". The ad URL pointed to orders-amazon-com.advancedfences.com, which redirected to a spoofed Amazon sign-in page hosted on sites.google.com. The page asked for an email or phone number and then displayed a fake CAPTCHA (ClickFix) that copies a command to the clipboard and instructs the user to paste it into the Windows Run dialog. Google has since removed the ad, but the attacker infrastructure remained online at publication.

The pasted command invokes finger.exe, a legacy Windows utility using TCP/79, as a living-off-the-land binary. The command is obfuscated with injected characters (commas, carets, hyphens, underscores) and queries a user on the attacker server grillrecipespro.com. The server's .plan response contains 68 carriage returns that hide the malicious script from casual viewing. The script downloads IronPython 3.4.2 from GitHub, extracts it to the Temp directory with a .pdf extension, and runs Base64/zlib-compressed Python through ipyw32.exe. That Python retrieves 'timer6' from grillmasterchef.com, a Base64 blob (with Cyrillic letter substitution) wrapping XOR-protected shellcode (19-byte key) for inline injection that borrows from the deprecated Veil framework.

The shellcode downloads the 'v6' payload, the Doina loader, whose first 64 bytes are the RC4 key; it is decrypted and injected into memory and looks for an .ini file holding further retrieval URLs. A separate stage downloads a ~52MB archive from kiriosyka.com containing a legitimate node.exe, package.json, node_modules and a malicious index.js, extracted to C:\ProgramData\NodeView. It checks in by HTTPS POST and then communicates over WebSocket; the server appends random null bytes to payloads and supports an exclude_bins=true update mode.

Lumma Stealer is delivered fileless as two GUID-named files (a ~17KB sRDI loader and a ~19MB AES-256-GCM encrypted stealer; first 12 bytes nonce, next 16 bytes key) and injected via reflective loading/process hollowing. It targets Chrome, Edge, Firefox and Opera, crypto wallets (Ledger, Electrum, Atomic Wallet), password managers (LastPass, Dashlane, 1Password, NordPass, RoboForm) and email clients. Check-in uses perfectgrillrecipes.com, exfiltration thegrilljournal.com and homelygrill.com, with liokida.com embedded. Finally, Client32.exe (NetSupport Client, using a pirated license over eight years old) is installed in C:\ProgramData\Prodclear and beacons over HTTPS to 167.148.201.106:725 (path fakeurl.htm); that IP serves a spoofed Detroit restaurant website. A macOS-targeted payload URL on ashevilleroofingcontractor.com was also observed. Earlier finger-based ClickFix clusters (KongTuke via captchaver.top; SmartApeSG via 91.193.19.108) were reported from Nov-Dec 2025, showing the technique is spreading. Attribution to a named actor was not made in the sources. Severity is an analyst judgment.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.001 Domains
- T1204.004 Malicious Copy and Paste
- T1059.006 Python
- T1059.007 JavaScript
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1555.003 Credentials from Web Browsers

## Sources

- [Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware](https://www.huntress.com/blog/amazon-clickfix-finger)
- [Decades-Old Windows Utility Powers Modern ClickFix Attack](https://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack)
- [Researchers Warn of ClickFix Campaign Targeting Amazon Business Users](https://petri.com/clickfix-campaign-targets-amazon-business-users/)
- [New Clickfix Attack Exploits finger.exe Tool to Trick Users into Execute Malicious Code](https://cybersecuritynews.com/new-clickfix-attack-exploits-finger-exe-tool/)
- [NetSupport RAT Campaign Evolves with ClickFix Technique](https://www.anvilogic.com/threat-reports/netsupport-rat-clickfix)
- [Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers](https://www.sentinelone.com/blog/how-clickfix-is-weaponizing-verification-fatigue-to-deliver-rats-infostealers/)
- [Fake CAPTCHA Lures Victims: Lumma Stealer Abuses Clipboard and PowerShell](https://www.seqrite.com/blog/fake-captcha-lures-victims-lumma-stealer-abuses-clipboard-and-powershell/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4327