> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ClickFix campaign abuses finger utility to deploy infostealers via spoofed Amazon login - URL: https://f4n6.co.uk/security-feed/clickfix-campaign-abuses-finger-utility-to-deploy-infostealers-via-spoofed-amazon-login/ - Published: 2026-10-21T14:16:10.000Z - Updated: 2026-10-21T14:16:10.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A malvertising campaign that surfaced as the top sponsored Google result for "amazon business" redirected victims to a spoofed Amazon login page hosted on Google Sites, then to a fake CAPTCHA that pastejacked a finger.exe command into the clipboard for the user to run in the Windows Run dialog. The finger command retrieved a Windows script from an attacker-controlled `.plan` file, which pulled IronPython and a chain of encoded Python scripts, a Doina loader, a Node.js-based modular downloader, a reflective DLL injector and an alleged Lumma Stealer, with a pirated NetSupport RMM client installed alongside. Huntress reports at least three of its own customers hit. No CVE has been assigned and no CISA KEV entry exists; the risk is to any EMEA financial services estate where staff use Windows endpoints, browse the open web and can reach port 79/tcp or port 725/tcp outbound. The stealer targets browser credential stores, cryptocurrency wallets, password managers and email clients, so a single successful paste can expose trading, treasury and privileged credentials. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain Huntress documented the full chain from a live infection. The Windows path is confirmed end to end; the macOS branch was observed as an instruction set but its payload URL was offline during research. 1. A sponsored Google search result for "amazon business" pointed to `orders-amazon[.]com[.]advancedfences[.]com`, a look-alike subdomain on an attacker-controlled domain. 2. The link redirected to a fake Amazon sign-in page hosted at `sites.google[.]com/view/ch-pc/sign-in`, which asked for an email address or phone number. 3. On submit, the page displayed a fake CAPTCHA. Clicking "I'm not a robot" wrote a pastejacked command to the clipboard and a pop-up told the user to run it in the Windows Run box. 4. The command invoked the built-in `finger.exe` against the account `DLVBUCeFfF@grillrecipespro[.]com`. The command text was obfuscated with commas, carets, hyphens and underscores, and padded with trailing spaces and hyphens so the Run dialog displayed only "Push the Enter key". 5. The finger response carried a Windows script inside the account's `.plan` file, pushed 68 carriage returns below the visible console area. Finger transmits this in plaintext over port 79/tcp. 6. The script spawned `curl` to download `IronPython.3.4.2.zip` from `github[.]com/IronLanguages/ironpython3/releases/download/v3.4.2/`, saved it to the user's Temp directory with a `.pdf` extension, unpacked it with `tar`, and ran `ipyw32.exe` from the `\net462` folder with a Base64-encoded, zlib-compressed Python blob as an argument. 7. That stage fetched `hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6`, a Python script encoded in Base64 with Cyrillic character substitution. The script reverses the substitution, decodes the blob, and unpacks a shellcode layer protected with a 19-byte XOR key (`84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c`). 8. The decoded output is a Windows PE loader that searches disk for an `.ini` file containing a URL, downloads the target with User-Agent `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36`, and RC4-decrypts it using the first 64 bytes of the downloaded file as the key. In this case it fetched `hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6`. 9. The decrypted `v6` payload is injected into memory and is assessed by vendor consensus as Doina, a modular loader/RAT/profiler. It immediately began HTTPS POST check-ins to the same grillmasterchef server. 10. Doina retrieved `hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6`, a 52MB ZIP containing a portable Node.js runtime and an obfuscated `index.js`. The archive was unpacked to `C:\ProgramData\NodeView` and `node.exe` was run with `index.js` as its argument. 11. `index.js` pulled two additional files with GUID-like names (about 17KB and over 19MB), both without a discernible PE header and with high entropy. It decrypted both with AES-256-GCM, using the first 12 bytes as nonce and the next 16 as key, then executed the smaller file. 12. The smaller file is a shellcode reflective DLL injector that hollowed a process and injected the larger file, assessed as Lumma Stealer. The stealer sent hostname, username and profiling data in an initial HTTPS POST, then switched to a websocket for continuous monitoring. 13. The websocket session carried the stealer download URL and a target list: Chrome, Edge, Firefox and Opera; Ledger, Electrum and Atomic Wallet; LastPass, Dashlane, 1Password, NordPass and RoboForm; email clients; and PowerShell. 14. Exfiltration used `thegrilljournal[.]com` and `homelygrill[.]com` after an initial check-in to `perfectgrillrecipes[.]com`. The stealer carries `liokida[.]com` embedded as a string. 15. A pirated NetSupport RMM client was installed under `C:\ProgramData\Prodclear`, with signed `Client32.exe` binaries dated roughly eight years ago, logging to a subdirectory. It communicated over HTTPS on port 725/tcp to `167.148.201[.]106`, requesting `fakeurl.htm`. The Node component supports two update modes: a full package of roughly 58MB including the Node interpreter, or a payload-only archive of just under 20MB requested with `?exclude_bins=true`. The server appends a random number of null bytes to each archive so every retrieval has a unique hash, and the payloads inside changed once or twice per day. Payloads, logs and related files were also written to the root of `C:\ProgramData\` and to folders beneath it. The macOS branch is single-sourced and was not captured live: visitors with a macOS User-Agent received Terminal instructions pointing at `hxxp[://]ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a`, which was offline at the time of research. Huntress notes that finger has been used in ClickFix lures for at least a year, and that timer6 shares the HeapCreate flag, HeapAlloc flag, buffer-copy pattern and native API sequence of Veil's `shellcode_inject/flat.py`, though it departs from the full Veil package in other behaviour. The Doina and Lumma Stealer identifications rest on vendor consensus rather than Huntress's own definitive attribution, and should be treated as assessed rather than proven. Separate macOS ClickFix activity reported by Microsoft and SANS uses different infrastructure and payloads (MacSync and Atomic Stealer, or an unnamed stealer) and is not part of this chain. It is relevant only as evidence that ClickFix lures are being served broadly and, in Microsoft's reporting, behind server-side browser fingerprinting that shows decoy pages to non-macOS visitors. ## 4\. Mitigation & containment P1 within 24 hours - Block outbound TCP 79 and TCP 725 at the perimeter and on host firewalls. Neither protocol has a business use on a modern financial services estate, and both are load-bearing for this chain. - Hunt for `finger.exe` execution and for any process making connections to port 79\. On EDR, alert on `finger.exe` spawning `curl.exe`, `tar.exe` or `ipyw32.exe`. - Search endpoints for `C:\ProgramData\NodeView`, `C:\ProgramData\Prodclear`, `ipyw32.exe` under user Temp, and any `.pdf` file in Temp that is actually a ZIP. Isolate hosts with hits and preserve memory before remediation, because the stealer and injector are fileless after stage 2. - Block the domains and IPs in §5 at proxy, DNS and mail gateways. Treat `sites.google[.]com/view/ch-pc/sign-in` as a specific URL block; the rest of Google Sites should not be blocked wholesale. - If a user ran the command, treat all credentials stored in browsers, password managers and cryptocurrency wallets on that host as compromised. Force reset of browser-saved credentials, rotate wallet seeds where held on the endpoint, and review email client tokens. - Disable or restrict the Windows Run dialog for users who do not need it. Huntress ships this as an "Attack Reduction" toggle in its Managed ESPM Early Access; equivalent Group Policy or EDR controls achieve the same result. P2 within 72 hours - Push user awareness content specific to this lure: no legitimate CAPTCHA asks a user to paste text into Run, Terminal, PowerShell or the command prompt. Include the "Push the Enter key" Run dialog appearance so staff recognise it. - Add proxy and browser-history hunting for the Google ad-click markers `aclk`, `gclid`, `gadsource`, `gadcampaignid` and `gbraid`. These survive later redirects and let investigators reconstruct the ad-to-payload path. Report matching ad URLs to Google. - Review EDR coverage for reflective DLL injection and process hollowing, and for websocket traffic from non-browser processes. The Lumma Stealer session is HTTPS websocket and will not be caught by URL categorisation alone. - Audit for unauthorised RMM installs. NetSupport under a non-standard folder with an eight-year-old signature is the pattern to hunt; compare against your approved RMM list. P3 within 7 days - Add the §6 YARA and Sigma rules to detection pipelines and tune against a week of telemetry. - Restrict `finger.exe` via AppLocker or WDAC where it is not required. It is a signed Microsoft binary and will not be caught by allow-listing that trusts the vendor. - Review egress filtering for non-standard high ports generally. Port 725 and port 79 both passed in the affected environments. ## 5\. Indicators of compromise | type | value | confidence | source | | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------------------------------- | | url | hxxps://orders-amazon-com\[.\]advancedfences\[.\]com/?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw\_wcB | high | Huntress | | url | hxxps://sites\[.\]google\[.\]com/view/ch-pc/sign-in | high | Huntress | | url | hxxp://ashevilleroofingcontractor\[.\]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a | medium | Huntress (offline at research time) | | domain | grillrecipespro\[.\]com | high | Huntress | | domain | thegrilljournal\[.\]com | high | Huntress | | domain | homelygrill\[.\]com | high | Huntress | | domain | perfectgrillrecipes\[.\]com | high | Huntress | | domain | embersandbites\[.\]com | high | Huntress | | domain | grillmasterchef\[.\]com | high | Huntress | | domain | kiriosyka\[.\]com | high | Huntress | | domain | liokida\[.\]com | high | Huntress | | url | hxxp://grillmasterchef\[.\]com/90e4a147-1234-505c-a024-062e543b5df8/timer6 | high | Huntress | | url | hxxps://grillmasterchef\[.\]com/90e4a147-1234-505c-a024-062e543b5df8/v6 | high | Huntress | | url | hxxps://kiriosyka\[.\]com/KsxmmKiN5N0j/sqr-viewertr6 | high | Huntress | | url | hxxps://liokida\[.\]com/KsxmmKiN5N0j/sqr-viewertr6z | medium | Huntress | | ipv4 | 167.148.201\[.\]106 | high | Huntress | | url | hxxp://167.148.201\[.\]106:725/fakeurl.htm | high | Huntress | | sha256 | d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649 | high | Huntress (timer6) | | sha256 | 891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e | high | Huntress (v6) | | sha256 | 87a047160eb1a9b92e6ede511252dfc624b0f5a7185ac2cec1c7ebde8cdf4eea | high | Huntress (index.js) | | sha256 | 035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7 | high | Huntress (NodeView.zip) | | sha256 | 24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f | high | Huntress (Lumma Stealer payload) | | sha256 | b8419a676a3d4af04ea98287a2b85052fae5c06e6278ca9d8bfa4b5b396b39a6 | high | Huntress (Lumma Stealer payload) | | sha256 | 42527a4388ef4ade6f4eaf52706f0ab31cb4e9ced3a56a6b15402551f9f01208 | high | Huntress (Lumma Stealer payload) | | sha256 | 408b7fc4f08f2a9044046025f05995e8cbd5c96c39844aaa8a7eb8ee4697ea89 | high | Huntress (Lumma Stealer payload) | Huntress's own table labels the five stealer payload hashes "SHA-256", which matches the 64-character length and is reproduced here as sha256\. The report lists the first stealer payload twice under the same filename and hash; it appears once above. The `IronPython.3.4.2.zip` archive and `Client32.exe` are legitimate signed components and are not listed as atomic indicators, though their presence in the paths above is suspicious in context. ```iocs url hxxps://orders-amazon-com[.]advancedfences[.]com/?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw_wcB url hxxps://sites[.]google[.]com/view/ch-pc/sign-in url hxxp://ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a domain grillrecipespro[.]com domain thegrilljournal[.]com domain homelygrill[.]com domain perfectgrillrecipes[.]com domain embersandbites[.]com domain grillmasterchef[.]com domain kiriosyka[.]com domain liokida[.]com url hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6 url hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6 url hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6 url hxxps://liokida[.]com/KsxmmKiN5N0j/sqr-viewertr6z ipv4 167.148.201[.]106 url hxxp://167.148.201[.]106:725/fakeurl.htm sha256 d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649 sha256 891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e sha256 87a047160eb1a9b92e6ede511252dfc624b0f5a7185ac2cec1c7ebde8cdf4eea sha256 035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7 sha256 24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f sha256 b8419a676a3d4af04ea98287a2b85052fae5c06e6278ca9d8bfa4b5b396b39a6 sha256 42527a4388ef4ade6f4eaf52706f0ab31cb4e9ced3a56a6b15402551f9f01208 sha256 408b7fc4f08f2a9044046025f05995e8cbd5c96c39844aaa8a7eb8ee4697ea89 ``` The full indicator set above is single-sourced to Huntress. Verify against your own telemetry before enforcing domain or IP blocks that could affect shared hosting. Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | ---------- | | finger.exe making outbound connections to port 79/tcp | EDR process network events, perimeter firewall | high | | finger.exe spawning curl.exe, tar.exe or ipyw32.exe | EDR process tree | high | | ipyw32.exe executed from a user Temp path with a Base64 argument | EDR command line | high | | ZIP archive written to Temp with a .pdf extension | File system monitoring | high | | node.exe launched from C:\\ProgramData\\NodeView with index.js argument | EDR process tree | high | | Client32.exe running from C:\\ProgramData\\Prodclear | EDR, file integrity monitoring | high | | Outbound HTTPS to port 725/tcp | Perimeter firewall, proxy | high | | Non-browser process opening a websocket session | Proxy, TLS inspection | medium | | Google ad-click markers aclk, gclid, gadsource, gadcampaignid, gbraid in proxy or browser history preceding a malicious redirect | Proxy logs, browser history | medium | ## 6\. Detection ```yara rule ClickFix_Finger_Doina_Node_Chain { meta: author = "Adverse Trace" date = "2026-10-21" reference = "https://www.huntress.com/blog/amazon-clickfix-finger" description = "Detects artefacts of the finger-based ClickFix chain: .plan-delivered script, timer6 loader, Node downloader and NetSupport drop paths" strings: $finger_user = "DLVBUCeFfF@grillrecipespro.com" ascii wide $plan_file = ".plan" ascii wide $ipyw = "ipyw32.exe" ascii wide $ironpy = "IronPython.3.4.2.zip" ascii wide $timer6 = "timer6" ascii wide $nodeview = "NodeView" ascii wide $prodclear = "Prodclear" ascii wide $exclude = "exclude_bins=true" ascii wide $fakeurl = "fakeurl.htm" ascii wide $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ascii wide $xor_key = { 84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c } condition: uint16(0) == 0x5A4D and 3 of them or 4 of them } ``` ```yaml title: ClickFix finger.exe chain spawning curl, tar or IronPython id: 8f3c2a71-4d6e-4b19-9c02-7a1e5d3b6f84 status: experimental description: Detects the finger.exe LOLbin pattern used in the Amazon-themed ClickFix campaign, where finger retrieves a .plan script that spawns curl, tar and ipyw32.exe author: Adverse Trace date: 2026/10/21 references: - https://www.huntress.com/blog/amazon-clickfix-finger logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: '\finger.exe' selection_child: Image|endswith: - '\curl.exe' - '\tar.exe' - '\ipyw32.exe' condition: selection_parent and selection_child fields: - ParentImage - Image - CommandLine - User falsepositives: - Legacy environments still using the finger client for diagnostics (rare) level: high ``` ```yaml title: Node.js runtime launched from C:\ProgramData\NodeView id: 2b7e9c14-6a83-4f52-b0d1-3e8c7a9f5d26 status: experimental description: Detects the Node.js downloader stage of the ClickFix chain, where node.exe runs index.js from C:\ProgramData\NodeView author: Adverse Trace date: 2026/10/21 references: - https://www.huntress.com/blog/amazon-clickfix-finger logsource: category: process_creation product: windows detection: selection: Image|endswith: '\node.exe' CommandLine|contains: 'NodeView' condition: selection fields: - Image - CommandLine - ParentImage falsepositives: - Developer tooling installed under C:\ProgramData\NodeView (verify against approved software list) level: high ``` ```yaml title: NetSupport Client running from non-standard ProgramData folder id: 5c1d8e42-9f37-4a6b-8e05-1b4d2c7a3f69 status: experimental description: Detects the pirated NetSupport RMM drop used in the ClickFix chain, installed under C:\ProgramData\Prodclear and communicating on port 725 author: Adverse Trace date: 2026/10/21 references: - https://www.huntress.com/blog/amazon-clickfix-finger logsource: category: process_creation product: windows detection: selection: Image|endswith: '\Client32.exe' Image|contains: '\ProgramData\Prodclear\' condition: selection fields: - Image - CommandLine - ParentImage falsepositives: - Approved NetSupport deployments (compare against the RMM allow-list; standard install paths differ) level: high ``` ## 7\. Sources - Huntress, "Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware", 2026-10-21\. https://www.huntress.com/blog/amazon-clickfix-finger - SANS Internet Storm Center, "Macfinger ClickFix campaign", 2026-09-22\. https://isc.sans.edu/diary/rss/33360 - SANS Internet Storm Center, "A Closer Look at Malware From the Macfinger ClickFix Campaign", 2026-09-25\. https://isc.sans.edu/diary/rss/33368 - Microsoft Threat Intelligence, "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide", 2026-08-05\. https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/ ## 8\. Adverse Trace position No CVE, CVSS score or CISA KEV entry applies to this item; it is a social-engineering and malware-delivery campaign, and severity is assessed on impact rather than a vulnerability score. The chain is confirmed on Windows by Huntress from a live infection, but the entire indicator set is single-sourced to that one report, so verify domains, IPs and hashes against your own telemetry before enforcing blocks. The Doina and Lumma Stealer identifications rest on vendor consensus rather than definitive analysis, and the macOS branch was not captured live. No threat actor is named in the source and no MITRE ATT&CK profile is available, so attribution is unconfirmed. Adverse Trace will monitor for additional reporting on the grill-themed infrastructure and the `liokida[.]com` and `kiriosyka[.]com` payload hosts, and will issue an update if the stealer family is confirmed or if the campaign expands beyond the current lure set. Clients should prioritise the port 79 and port 725 egress blocks and the `C:\ProgramData\NodeView` and `C:\ProgramData\Prodclear` hunts today, because the fileless stages leave little on disk to find after the fact. --- [Read the original source →](https://www.huntress.com/blog/amazon-clickfix-finger?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*