ClickFix campaign abuses finger utility to deploy infostealers via spoofed Amazon login

1. Executive summary

A malvertising campaign that surfaced as the top sponsored Google result for "amazon business" redirected victims to a spoofed Amazon login page hosted on Google Sites, then to a fake CAPTCHA that pastejacked a finger.exe command into the clipboard for the user to run in the Windows Run dialog. The finger command retrieved a Windows script from an attacker-controlled .plan file, which pulled IronPython and a chain of encoded Python scripts, a Doina loader, a Node.js-based modular downloader, a reflective DLL injector and an alleged Lumma Stealer, with a pirated NetSupport RMM client installed alongside. Huntress reports at least three of its own customers hit. No CVE has been assigned and no CISA KEV entry exists; the risk is to any EMEA financial services estate where staff use Windows endpoints, browse the open web and can reach port 79/tcp or port 725/tcp outbound. The stealer targets browser credential stores, cryptocurrency wallets, password managers and email clients, so a single successful paste can expose trading, treasury and privileged credentials.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

Huntress documented the full chain from a live infection. The Windows path is confirmed end to end; the macOS branch was observed as an instruction set but its payload URL was offline during research.

1. A sponsored Google search result for "amazon business" pointed to orders-amazon[.]com[.]advancedfences[.]com, a look-alike subdomain on an attacker-controlled domain.
2. The link redirected to a fake Amazon sign-in page hosted at sites.google[.]com/view/ch-pc/sign-in, which asked for an email address or phone number.
3. On submit, the page displayed a fake CAPTCHA. Clicking "I'm not a robot" wrote a pastejacked command to the clipboard and a pop-up told the user to run it in the Windows Run box.
4. The command invoked the built-in finger.exe against the account DLVBUCeFfF@grillrecipespro[.]com. The command text was obfuscated with commas, carets, hyphens and underscores, and padded with trailing spaces and hyphens so the Run dialog displayed only "Push the Enter key".
5. The finger response carried a Windows script inside the account's .plan file, pushed 68 carriage returns below the visible console area. Finger transmits this in plaintext over port 79/tcp.
6. The script spawned curl to download IronPython.3.4.2.zip from github[.]com/IronLanguages/ironpython3/releases/download/v3.4.2/, saved it to the user's Temp directory with a .pdf extension, unpacked it with tar, and ran ipyw32.exe from the \net462 folder with a Base64-encoded, zlib-compressed Python blob as an argument.
7. That stage fetched hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6, a Python script encoded in Base64 with Cyrillic character substitution. The script reverses the substitution, decodes the blob, and unpacks a shellcode layer protected with a 19-byte XOR key (84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c).
8. The decoded output is a Windows PE loader that searches disk for an .ini file containing a URL, downloads the target with User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, and RC4-decrypts it using the first 64 bytes of the downloaded file as the key. In this case it fetched hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6.
9. The decrypted v6 payload is injected into memory and is assessed by vendor consensus as Doina, a modular loader/RAT/profiler. It immediately began HTTPS POST check-ins to the same grillmasterchef server.
10. Doina retrieved hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6, a 52MB ZIP containing a portable Node.js runtime and an obfuscated index.js. The archive was unpacked to C:\ProgramData\NodeView and node.exe was run with index.js as its argument.
11. index.js pulled two additional files with GUID-like names (about 17KB and over 19MB), both without a discernible PE header and with high entropy. It decrypted both with AES-256-GCM, using the first 12 bytes as nonce and the next 16 as key, then executed the smaller file.
12. The smaller file is a shellcode reflective DLL injector that hollowed a process and injected the larger file, assessed as Lumma Stealer. The stealer sent hostname, username and profiling data in an initial HTTPS POST, then switched to a websocket for continuous monitoring.
13. The websocket session carried the stealer download URL and a target list: Chrome, Edge, Firefox and Opera; Ledger, Electrum and Atomic Wallet; LastPass, Dashlane, 1Password, NordPass and RoboForm; email clients; and PowerShell.
14. Exfiltration used thegrilljournal[.]com and homelygrill[.]com after an initial check-in to perfectgrillrecipes[.]com. The stealer carries liokida[.]com embedded as a string.
15. A pirated NetSupport RMM client was installed under C:\ProgramData\Prodclear, with signed Client32.exe binaries dated roughly eight years ago, logging to a subdirectory. It communicated over HTTPS on port 725/tcp to 167.148.201[.]106, requesting fakeurl.htm.

The Node component supports two update modes: a full package of roughly 58MB including the Node interpreter, or a payload-only archive of just under 20MB requested with ?exclude_bins=true. The server appends a random number of null bytes to each archive so every retrieval has a unique hash, and the payloads inside changed once or twice per day. Payloads, logs and related files were also written to the root of C:\ProgramData\ and to folders beneath it.

The macOS branch is single-sourced and was not captured live: visitors with a macOS User-Agent received Terminal instructions pointing at hxxp[://]ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a, which was offline at the time of research. Huntress notes that finger has been used in ClickFix lures for at least a year, and that timer6 shares the HeapCreate flag, HeapAlloc flag, buffer-copy pattern and native API sequence of Veil's shellcode_inject/flat.py, though it departs from the full Veil package in other behaviour. The Doina and Lumma Stealer identifications rest on vendor consensus rather than Huntress's own definitive attribution, and should be treated as assessed rather than proven.

Separate macOS ClickFix activity reported by Microsoft and SANS uses different infrastructure and payloads (MacSync and Atomic Stealer, or an unnamed stealer) and is not part of this chain. It is relevant only as evidence that ClickFix lures are being served broadly and, in Microsoft's reporting, behind server-side browser fingerprinting that shows decoy pages to non-macOS visitors.

4. Mitigation & containment

P1 within 24 hours

• Block outbound TCP 79 and TCP 725 at the perimeter and on host firewalls. Neither protocol has a business use on a modern financial services estate, and both are load-bearing for this chain.
• Hunt for finger.exe execution and for any process making connections to port 79. On EDR, alert on finger.exe spawning curl.exe, tar.exe or ipyw32.exe.
• Search endpoints for C:\ProgramData\NodeView, C:\ProgramData\Prodclear, ipyw32.exe under user Temp, and any .pdf file in Temp that is actually a ZIP. Isolate hosts with hits and preserve memory before remediation, because the stealer and injector are fileless after stage 2.
• Block the domains and IPs in §5 at proxy, DNS and mail gateways. Treat sites.google[.]com/view/ch-pc/sign-in as a specific URL block; the rest of Google Sites should not be blocked wholesale.
• If a user ran the command, treat all credentials stored in browsers, password managers and cryptocurrency wallets on that host as compromised. Force reset of browser-saved credentials, rotate wallet seeds where held on the endpoint, and review email client tokens.
• Disable or restrict the Windows Run dialog for users who do not need it. Huntress ships this as an "Attack Reduction" toggle in its Managed ESPM Early Access; equivalent Group Policy or EDR controls achieve the same result.

P2 within 72 hours

• Push user awareness content specific to this lure: no legitimate CAPTCHA asks a user to paste text into Run, Terminal, PowerShell or the command prompt. Include the "Push the Enter key" Run dialog appearance so staff recognise it.
• Add proxy and browser-history hunting for the Google ad-click markers aclk, gclid, gadsource, gadcampaignid and gbraid. These survive later redirects and let investigators reconstruct the ad-to-payload path. Report matching ad URLs to Google.
• Review EDR coverage for reflective DLL injection and process hollowing, and for websocket traffic from non-browser processes. The Lumma Stealer session is HTTPS websocket and will not be caught by URL categorisation alone.
• Audit for unauthorised RMM installs. NetSupport under a non-standard folder with an eight-year-old signature is the pattern to hunt; compare against your approved RMM list.

P3 within 7 days

• Add the §6 YARA and Sigma rules to detection pipelines and tune against a week of telemetry.
• Restrict finger.exe via AppLocker or WDAC where it is not required. It is a signed Microsoft binary and will not be caught by allow-listing that trusts the vendor.
• Review egress filtering for non-standard high ports generally. Port 725 and port 79 both passed in the affected environments.

5. Indicators of compromise

Huntress's own table labels the five stealer payload hashes "SHA-256", which matches the 64-character length and is reproduced here as sha256. The report lists the first stealer payload twice under the same filename and hash; it appears once above. The IronPython.3.4.2.zip archive and Client32.exe are legitimate signed components and are not listed as atomic indicators, though their presence in the paths above is suspicious in context.

url  hxxps://orders-amazon-com[.]advancedfences[.]com/?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw_wcB
url  hxxps://sites[.]google[.]com/view/ch-pc/sign-in
url  hxxp://ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a
domain  grillrecipespro[.]com
domain  thegrilljournal[.]com
domain  homelygrill[.]com
domain  perfectgrillrecipes[.]com
domain  embersandbites[.]com
domain  grillmasterchef[.]com
domain  kiriosyka[.]com
domain  liokida[.]com
url  hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6
url  hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6
url  hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6
url  hxxps://liokida[.]com/KsxmmKiN5N0j/sqr-viewertr6z
ipv4  167.148.201[.]106
url  hxxp://167.148.201[.]106:725/fakeurl.htm
sha256  d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649
sha256  891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e
sha256  87a047160eb1a9b92e6ede511252dfc624b0f5a7185ac2cec1c7ebde8cdf4eea
sha256  035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7
sha256  24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f
sha256  b8419a676a3d4af04ea98287a2b85052fae5c06e6278ca9d8bfa4b5b396b39a6
sha256  42527a4388ef4ade6f4eaf52706f0ab31cb4e9ced3a56a6b15402551f9f01208
sha256  408b7fc4f08f2a9044046025f05995e8cbd5c96c39844aaa8a7eb8ee4697ea89

The full indicator set above is single-sourced to Huntress. Verify against your own telemetry before enforcing domain or IP blocks that could affect shared hosting.

Behavioural indicators

6. Detection

rule ClickFix_Finger_Doina_Node_Chain
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-21"
        reference = "https://www.huntress.com/blog/amazon-clickfix-finger"
        description = "Detects artefacts of the finger-based ClickFix chain: .plan-delivered script, timer6 loader, Node downloader and NetSupport drop paths"
    strings:
        $finger_user = "DLVBUCeFfF@grillrecipespro.com" ascii wide
        $plan_file   = ".plan" ascii wide
        $ipyw        = "ipyw32.exe" ascii wide
        $ironpy      = "IronPython.3.4.2.zip" ascii wide
        $timer6      = "timer6" ascii wide
        $nodeview    = "NodeView" ascii wide
        $prodclear   = "Prodclear" ascii wide
        $exclude     = "exclude_bins=true" ascii wide
        $fakeurl     = "fakeurl.htm" ascii wide
        $ua          = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ascii wide
        $xor_key     = { 84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c }
    condition:
        uint16(0) == 0x5A4D and 3 of them
        or 4 of them
}

title: ClickFix finger.exe chain spawning curl, tar or IronPython
id: 8f3c2a71-4d6e-4b19-9c02-7a1e5d3b6f84
status: experimental
description: Detects the finger.exe LOLbin pattern used in the Amazon-themed ClickFix campaign, where finger retrieves a .plan script that spawns curl, tar and ipyw32.exe
author: Adverse Trace
date: 2026/10/21
references:

    - https://www.huntress.com/blog/amazon-clickfix-finger
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\finger.exe'
    selection_child:
        Image|endswith:

            - '\curl.exe'
            - '\tar.exe'
            - '\ipyw32.exe'
    condition: selection_parent and selection_child
fields:

    - ParentImage
    - Image
    - CommandLine
    - User
falsepositives:

    - Legacy environments still using the finger client for diagnostics (rare)
level: high

title: Node.js runtime launched from C:\ProgramData\NodeView
id: 2b7e9c14-6a83-4f52-b0d1-3e8c7a9f5d26
status: experimental
description: Detects the Node.js downloader stage of the ClickFix chain, where node.exe runs index.js from C:\ProgramData\NodeView
author: Adverse Trace
date: 2026/10/21
references:

    - https://www.huntress.com/blog/amazon-clickfix-finger
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains: 'NodeView'
    condition: selection
fields:

    - Image
    - CommandLine
    - ParentImage
falsepositives:

    - Developer tooling installed under C:\ProgramData\NodeView (verify against approved software list)
level: high

title: NetSupport Client running from non-standard ProgramData folder
id: 5c1d8e42-9f37-4a6b-8e05-1b4d2c7a3f69
status: experimental
description: Detects the pirated NetSupport RMM drop used in the ClickFix chain, installed under C:\ProgramData\Prodclear and communicating on port 725
author: Adverse Trace
date: 2026/10/21
references:

    - https://www.huntress.com/blog/amazon-clickfix-finger
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Client32.exe'
        Image|contains: '\ProgramData\Prodclear\'
    condition: selection
fields:

    - Image
    - CommandLine
    - ParentImage
falsepositives:

    - Approved NetSupport deployments (compare against the RMM allow-list; standard install paths differ)
level: high

7. Sources

• Huntress, "Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware", 2026-10-21. https://www.huntress.com/blog/amazon-clickfix-finger
• SANS Internet Storm Center, "Macfinger ClickFix campaign", 2026-09-22. https://isc.sans.edu/diary/rss/33360
• SANS Internet Storm Center, "A Closer Look at Malware From the Macfinger ClickFix Campaign", 2026-09-25. https://isc.sans.edu/diary/rss/33368
• Microsoft Threat Intelligence, "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide", 2026-08-05. https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/

8. Adverse Trace position

No CVE, CVSS score or CISA KEV entry applies to this item; it is a social-engineering and malware-delivery campaign, and severity is assessed on impact rather than a vulnerability score. The chain is confirmed on Windows by Huntress from a live infection, but the entire indicator set is single-sourced to that one report, so verify domains, IPs and hashes against your own telemetry before enforcing blocks. The Doina and Lumma Stealer identifications rest on vendor consensus rather than definitive analysis, and the macOS branch was not captured live. No threat actor is named in the source and no MITRE ATT&CK profile is available, so attribution is unconfirmed. Adverse Trace will monitor for additional reporting on the grill-themed infrastructure and the liokida[.]com and kiriosyka[.]com payload hosts, and will issue an update if the stealer family is confirmed or if the campaign expands beyond the current lure set. Clients should prioritise the port 79 and port 725 egress blocks and the C:\ProgramData\NodeView and C:\ProgramData\Prodclear hunts today, because the fileless stages leave little on disk to find after the fact.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.