ClickFix Attack Uses Windows Finger Utility to Deliver Lumma Stealer and NetSupport
Summary
Huntress researchers found a ClickFix campaign using a fake Amazon login and CAPTCHA to invoke Windows’ finger utility and deliver Lumma Stealer and NetSupport. Google removed the malicious ad, but the researchers said attacker infrastructure remained active.
Key points
- The attack began with a sponsored Google result for “amazon business” that led users to a spoofed Amazon login page and fake CAPTCHA.
- Engaging with the CAPTCHA triggered Windows’ built-in finger utility, which retrieved attacker-controlled content and started a multistage delivery chain.
- The reported payloads included Lumma Stealer and a pirated NetSupport Client remote management tool; the chain also used IronPython and obfuscated loaders.
- Google removed the malicious ad, but Huntress researchers said the attacker infrastructure remained online and functional.
- Researchers recommended monitoring unexpected finger.exe activity and outbound TCP/79, reviewing rarely used utilities, and watching for unusual staging and hidden NetSupport activity.
- Huntress reported that ClickFix accounted for about 2.2% of its Managed EDR detection signals so far that year, with nearly 99% of those detections rated high severity.
Article Details
- Event Type
- ClickFix attack using the Windows finger utility to deliver multiple payloads
- Impact
- The attack can compromise user machines with an infostealer and remote management software. Researchers reported that the payload chain included a version of Lumma Stealer and a pirated copy of NetSupport Client.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | orders-amazon[.]com[.]advancedfences[.]com | Domain hosting the malicious sponsored search result that led to a fake Amazon login page. |
MITRE ATT&CK
People
Malware
Vendors
Products
Google Sitesand the link redirected to a fake Amazon login page, which was hosted in a private Google Sites cloud storage location, according to the report.Microsoft WindowsA new ClickFix attack is leveraging a legacy Windows utility to run malicious commands that compromise user machines with an infostealer and remote management software, demonstrating how even technological relics canNetSupport Managerattack chain that ends with the dropping of multiple payloads, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer.