Decades-Old Windows Utility Powers Modern ClickFix Attack

The attack uses malicious Google search results related to Amazon and leverages the ‘finger’ utility to launch a CAPTCHA that installs malware, including the Lumma stealer.

A new ClickFix attack is leveraging a legacy Window utility to run malicious commands that comprise user machines with an infostealer and remote-management software, demonstrating how even technological relics can present an opportunity for attacker exploitation.

Discovered by researchers at Huntress, the attack relied on users clicking on a sponsored Google search result for the keywords “amazon business,” and then spoofs an Amazon login page with an embedded ClickFix attack in the form of a fake CATPCHA challenge, according to a report published today.

The page prompted the user to enter their email or phone number, and once these fields are completed, popped up a fake CAPTCHA on which ClickFix attacks typically are anchored, Huntress researchers Sarah Reddish and Spike Brandt revealed in the report.

It’s when users engage with the CAPTCHA that the attack calls on Windows’ built-in finger utility, a relic of the early Internet first introduced in early 1970s that attackers use as a living off the land binary (LOLBIN), they said. A finger command kicks off a complex, multi-layered attack chain that ends with the dropping of multiple payloads, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer.

Attackers hosted the malicious result on a “suspicious” domain, orders-amazon[.]com[.]advancedfences[.]com, and the link redirected to a fake Amazon login page, which was hosted in a private Google Sites cloud storage location, according to the report.

Google has since removed the malicious ad, but the attacker infrastructure remains online and functional, with attackers preferentially using a growing list of “barbeque-themed” domain names, the researchers said.

Finger Points to Danger

The use of the finger utility is part of the difference between this attack and previous ClickFix-style attacks, which since the technique’s emergence in 2024 has become a favorite of threat actors.

“The difference here is the depth of the chain,” Reddish, Huntress security operations analyst, tells Dark Reading. “Instead of moving directly from the user’s action to one payload, a fake CAPTCHA used finger.exe, which executes a remote .plan file, installs IronPython, multiple obfuscated loaders, an alleged Lumma Stealer sample, and a hidden NetSupport Client.”

Overall, this “shows ClickFix evolving from a simple user trick into a modular delivery path for multiple payloads, designed to make it harder for the analyst to investigate,” she says.

Threat actors have abused legitimate services in previous ClickFix campaigns. In this case, finger is useful to attackers because it’s still present on many systems, yet “few users or defenders expect to see it,” Reddish observes. “‘Old’ doesn’t mean ‘irrelevant,'” she says. “Here, it retrieved attacker-controlled text from a remote .plan file and quietly handed the attack to the next stage.”

Indeed, finger offers advantages for attackers due to the inherent evasion that using the utility provides in the first place, adds Brandt, principal threat intelligence incident commander for Huntress. “It uses a static TCP/IP port number but it is not proxy-aware, and firewalls, network filters, or DLP tools may also ignore traffic on that port because it is so uncommon,” he observes.

Given this, “that same entry point could lead to the installation of many types of malware, like an infostealer, RAT, ransomware, or remote-management tool,” Reddish notes.

Defending Against Unexpected Attack Vectors

The finger utility attacks illustrates a trend that Huntress analysts have seen in ClickFix activity, as attackers pair the use of legitimate services and utilities with “trusted brands, sponsored ads, built-in utilities, modular payloads, and platform-specific lures,” to blend more with legitimate online activity, Reddish observes.

Moreover, ClickFix accounted for roughly 2.2% of Huntress Managed EDR detection signals so far this year, and nearly 99% of those detections were high severity, she says. This calls for defenders to become even more savvy against this style of attacks, both from the perspective of living-off-the-land (LotL) and ClickFix techniques, the researchers say.

To thwart the former, security teams should inventory legitimate tools commonly — or uncommonly — exploited by attackers, “disable anything with no business purpose, and alert when rarely used utilities suddenly appear in user-driven execution chains,” Brandt advises.

They also can monitor or block outbound TCP/79, alert on unexpected finger.exe activity, restrict the Run dialog where possible, and watch for unusual staging under C:ProgramData, hidden NetSupport activity, and nonstandard ports such as TCP/725, Reddish says.

As a general rule, security teams can mitigate ClickFix threats by teaching users “that no legitimate CAPTCHA asks them to paste a command into Run, PowerShell, or Command Prompt,” the vector on which these attacks rely to compromise victims, she adds.