GoKawiilHuntress Finds ClickFix Attack Abusing Windows' 1970s Finger Utility via Fake Amazon Ad
Huntress researchers Sarah Reddish and Spike Brandt detailed a ClickFix campaign that begins with a sponsored Google ad for 'amazon business,' redirecting victims through a suspicious domain to a spoofed Amazon login page hosted on Google Sites. A fake CAPTCHA on that page triggers Windows' decades-old finger utility, which launches a multi-stage chain delivering a pirated NetSupport Client RMM tool and Lumma Stealer infostealer malware. Google has pulled the malicious ad, but the attackers' infrastructure, which now uses barbeque-themed domain names, remains active.