GoKawiilHuntress Finds ClickFix Attack Abusing Windows' 1970s Finger Utility via Fake Amazon Ad
Huntress researchers Sarah Reddish and Spike Brandt detailed a ClickFix campaign that begins with a sponsored Google ad for 'amazon business,' redirecting victims through a suspicious domain to a spoofed Amazon login page hosted on Google Sites. A fake CAPTCHA on that page triggers Windows' decades-old finger utility, which launches a multi-stage chain delivering a pirated NetSupport Client RMM tool and Lumma Stealer infostealer malware. Google has pulled the malicious ad, but the attackers' infrastructure, which now uses barbeque-themed domain names, remains active.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign shows attackers continuing to repurpose obscure, trusted Windows binaries like finger as 'living off the land' tools to evade detection, since such utilities rarely raise security alarms. It also underscores how paid search ads and legitimate cloud hosting services like Google Sites can be weaponized to lend credibility to phishing pages, suggesting defenders need to scrutinize sponsored results and unusual process behavior rather than relying solely on domain reputation.
- Attackers abuse Windows' legacy finger utility as a 'living off the land' binary to avoid detection.
- The attack chain starts with a sponsored Google ad impersonating Amazon Business and a fake CAPTCHA.
- Final payloads include a pirated NetSupport RMM tool and Lumma Stealer; Google removed the ad but attacker infrastructure persists.
Source: darkreading.com — Elizabeth Montalbano, 2026-10-21
Published there as: “Decades-Old Windows Utility Powers Modern ClickFix Attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.