Amazon-Themed ClickFix Campaign Uses Windows Finger to Deliver Doina and Lumma Stealer

Oct 21, 2026 · Original article ↗

Summary

Huntress traced an Amazon-themed ClickFix campaign affecting at least three customers: a fake login and CAPTCHA used finger.exe to launch a multi-stage chain delivering Doina, allegedly Lumma Stealer, and pirated NetSupport. Google removed the ad, but infrastructure was

Key points

A sponsored Google search for “amazon business” led to a spoofed Amazon login and fake CAPTCHA that copied a command to the clipboard and instructed users to run it.
The command used Windows finger.exe to retrieve a script from an attacker-controlled .plan file over TCP port 79, launching the infection chain.
The chain used IronPython and obfuscated scripts to load Doina; Doina then retrieved a Node.js package containing a malicious script and additional payloads.
The Node.js component decrypted and injected an infostealer identified by the article as allegedly Lumma Stealer, which targeted browsers, cryptocurrency wallets, password managers, and email clients.
A pirated NetSupport Client was also installed under C:\ProgramData and communicated over HTTPS on TCP port 725.
Huntress connected attacker infrastructure through shared hosting, DNS, and payload relationships; Google had removed the malicious ad, while the infrastructure remained online at the time of the investigation.
The article recommends user awareness of ClickFix prompts, using Google ad-click markers in investigations, and optionally restricting access to the Windows Run dialog.

Article Details

Attack Vectors: A sponsored Google search result led to an attacker-controlled site impersonating Amazon and presenting a fake CAPTCHA.
The fake CAPTCHA used ClickFix social engineering to copy a command to the clipboard and instruct the victim to run it through the Windows Run dialog.
The command invoked Windows finger.exe to retrieve a script from an attacker-controlled .plan file over port 79/tcp.
The retrieved script downloaded IronPython and executed an obfuscated Python script, which retrieved and decrypted additional malware.
A Node.js script downloaded and decrypted payloads, including a reflective DLL injector and a Lumma Stealer payload that used process hollowing.
The infection also deployed a pirated NetSupport Client installation for remote access.
Defensive Notes: Warn users that legitimate CAPTCHAs do not ask them to paste commands into an operating-system prompt.
Review browser history, proxy logs, and URL telemetry for Google ad-click markers such as aclk and gclid; Huntress recommends reporting malicious ad identifiers to Google.
Monitor or block Finger protocol traffic on port 79/tcp, which the article identifies as the mechanism used to retrieve the initial script.
Consider restricting access to the Windows Run dialog for users who do not need it; the article notes this will not prevent other ClickFix variants.
Google had removed the reported malicious ad, but the article reported that attacker infrastructure remained online and functional.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`embersandbites[.]com`	Listed among the campaign's attacker-controlled C2 and payload-delivery domains.
DOMAIN	`grillmasterchef[.]com`	Attacker infrastructure used to deliver the timer6 script and subsequent malware.
DOMAIN	`grillrecipespro[.]com`	Attacker-controlled domain hosting the Finger/.plan script retrieved by the initial command.
DOMAIN	`homelygrill[.]com`	Identified as attacker infrastructure used for stealer exfiltration.
DOMAIN	`kiriosyka[.]com`	Attacker-used domain hosting malware packages, including the Node.js package.
DOMAIN	`liokida[.]com`	Reported attacker-used domain hosting Node.js and stealer packages and embedded in the stealer.
DOMAIN	`perfectgrillrecipes[.]com`	Attacker-controlled C2 domain used for the stealer's initial check-in.
DOMAIN	`thegrilljournal[.]com`	Identified as attacker infrastructure used for stealer exfiltration.
IPV4	`167[.]148[.]201[.]106`	IP address used by the rogue NetSupport Client installation for C2 over port 725/tcp.
SHA256	`035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7`	Hash of the Nodeview.zip package delivered as part of the malware package.
SHA256	`24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f`	Hash of a decrypted Lumma Stealer payload.
SHA256	`408b7fc4f08f2a9044046025f05995e8cbd5c96c39844aaa8a7eb8ee4697ea89`	Hash of a decrypted Lumma Stealer payload.
SHA256	`42527a4388ef4ade6f4eaf52706f0ab31cb4e9ced3a56a6b15402551f9f01208`	Hash of a decrypted Lumma Stealer payload.
SHA256	`87a047160eb1a9b92e6ede511252dfc624b0f5a7185ac2cec1c7ebde8cdf4eea`	Hash of index.js, the obfuscated malicious Node.js script used to retrieve and execute payloads.
SHA256	`891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e`	Hash of the V6 response body that was decrypted into a malware executable.
SHA256	`b8419a676a3d4af04ea98287a2b85052fae5c06e6278ca9d8bfa4b5b396b39a6`	Hash of a decrypted Lumma Stealer payload.
SHA256	`d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649`	Hash of the obfuscated timer6 Python script used in the malware delivery chain.
URL	`hxxp[:]//167[.]148[.]201[.]106:725/fakeurl.htm`	NetSupport Client C2 URL used by the malicious installation.
URL	`hxxp[:]//ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a`	Alternate macOS payload URL provided by the campaign; it was offline during Huntress's research.
URL	`hxxp[:]//grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6`	Attacker-controlled URL serving the encoded Python script in the infection chain.
URL	`hxxps[:]//grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6`	Attacker-controlled URL serving the encrypted malware executable retrieved by the loader.
URL	`hxxps[:]//kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6`	Attacker-used payload URL serving the Node.js package and malicious script.
URL	`hxxps[:]//liokida[.]com/KsxmmKiN5N0j/sqr-viewertr6z`	Reported attacker-used URL hosting Node.js and stealer payload packages.
URL	`hxxps[:]//orders-amazon-com[.]advancedfences[.]com/?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw_wcB`	Malicious sponsored-ad URL leading to the spoofed Amazon ClickFix campaign.
URL	`hxxps[:]//sites[.]google[.]com/view/ch-pc/sign-in?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw_wcB`	Specific Google Sites resource identified as the fake Amazon login and ClickFix landing page.